Asking a supplier about VEX tells you how they handle vulnerability communication. These eight questions are drawn from what the CISA minimum requirements and the common formats define. None of them assumes the supplier must publish VEX, because no such requirement exists. They simply separate prepared suppliers from the rest.
1. Do you publish VEX, and in which format?
CISA names CSAF, CycloneDX and OpenVEX as formats that can contain or generate VEX. Any is acceptable. What matters is that it is machine-readable and documented.
2. Are the documents signed, and how do we verify?
The requirements say VEX should be signed and the author tied to the signer. Ask for the verification method in writing.
3. How often is it updated, and how do we get notified?
The standards do not define an exchange mechanism. Ask whether there is a stable URL, a feed, or a notification email, and whether the document version increments on every change.
4. Which versions of the product do you cover?
Statements are tied to product identifiers. Ask whether older supported releases get statements, or only the current one.
5. Do you match your product identifiers to an SBOM?
CISA says identifiers should reference existing SBOM identifiers. Ask whether the supplier ships an SBOM with matching package URLs or hashes.
6. What evidence sits behind not_affected claims?
Ask which justification values you will see most. Component not present and code not built can be checked from artifacts. Execute path claims rely on analysis. Two values are hard to prove conclusively, per the OpenVEX spec. A candid answer here is a good sign.
7. What is your target time from disclosure to first statement?
Under_investigation is a legitimate first status. Ask how quickly it appears, and how long suppliers typically stay in it.
8. What happens when a statement changes from not_affected to affected?
You want a commitment to bump versions, update timestamps and notify customers.
How to score the answers
| Signal | Good | Concerning |
|---|---|---|
| Format | Documented, standard | Proprietary PDF only |
| Signing | Verification instructions | None |
| Cadence | Defined, versioned | Ad hoc |
| Evidence | Specific, checkable | Vague |
A supplier that publishes nothing is not necessarily careless, but you should plan more scanner triage of your own.
Putting it in a questionnaire
Add the eight questions as a short section. Record answers with dates, because VEX practices change.
Quick check
Should VEX be a contract requirement?
That is a commercial decision. The CISA document does not mandate it, so any requirement would come from your own contract.
Sources
Last reviewed: 19 October 2026.
