Give one named owner the process and split the work by what each team knows. Product security owns statuses and sharing rules, engineering owns generation and accuracy, legal owns access terms, and sales or support owns the customer conversation. One owner prevents conflicting answers.
Why ownership matters
The CISA VEX document says the author is responsible for the content of a VEX document and must be an individual or organisation. It also says VEX can be authored by the supplier or by a third party. For a vendor, that means someone has to be accountable for each statement, and the NTIA report adds that SBOM arrangements need terms for frequency, access and corrections. Both point to the same need: named roles.
A simple role split
| Role | Owns | Does not own |
|---|---|---|
| Product security | Statuses and justifications, advisory decisions, what is safe to share | Customer relationship |
| Engineering | Build configuration, SBOM generation, identifiers in the files | Legal terms |
| Legal | Access and usage terms, contract language | Technical accuracy |
| Sales or support | Intake, expectations, delivery logging | Status decisions |
| Release management | Making sure each release produces its SBOM | Customer replies |
Working agreements
- One queue. All requests go to a single mailbox or ticket type, whoever they first reach.
- One decision maker for statuses. Engineers propose, product security decides, and the decision is recorded with its reason.
- One approved boilerplate for access terms from legal, used unless a deal needs a change.
- A shared log of what was sent, to whom, and when. The CISA text expects documents to carry dates and versions, so your log should too.
- A monthly review of open under-investigation items.
Escalation path
Define who decides in three awkward cases: a customer demands a format you do not produce, a customer disputes a not-affected statement, and a customer asks for a restricted internal document. Each case should have a named person and a time limit.
Small teams
In a small company one person may hold several roles. Keep the roles separate on paper anyway. It makes handover easier and shows customers there is a process.
Try it yourself
Open the demo and think about who in your company would own each column, from detection to fix. The same exercise helps you assign SBOM and VEX work.
Click through it at your own pace, or open it full screen.
Quick check
Can sales answer SBOM questions alone?
For intake and logistics, yes. Status claims need product security sign off.
Do we need a dedicated person?
Not at first. You need a named owner with time to run the process, even if it is part of another job.
Safeguard's policies, gates and guardrails and SBOM and dependency scanning can support the evidence side of this work, and the free scan is an easy start.
Sources
- Minimum Requirements for Vulnerability Exploitability eXchange (VEX), CISA, April 2023
- The Minimum Elements For a Software Bill of Materials (NTIA, 2021)
Last reviewed: 19 October 2026.
