CSAF

OASIS Common Security Advisory Framework v2.0 Approved as an ISO/IEC International Standard

Boston, MA USA; 20 May 2025 — The Common Security Advisory Framework (CSAF) Version 2.0, an open standard developed by OASIS Open, has officially been approved for release by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Now designated as ‘ISO/IEC 20153,’ the framework was successfully balloted through the Joint Technical Committee on Information Technology (JTC 1), marking a significant step forward in global security advisory standardization.

“Congratulations to OASIS on the publication of ISO/IEC 20153,” said Philip Wennblom, Chair of ISO/IEC JTC 1. “OASIS has been a valued JTC 1 partner since 2004, and this milestone highlights the strength of our collaboration in addressing critical challenges, including in cybersecurity, and advancing standards that benefit consumers, industries, and governments worldwide.”

Developed by the OASIS CSAF Technical Committee (TC) through a collaborative, cross-industry effort, CSAF v2.0 provides a modern, machine-readable framework for enhancing vulnerability reporting and response. With support for the Vulnerability Exploitability Exchange (VEX) profile, CSAF v2.0 seamlessly integrates with Software Bill of Materials (SBOM) data, allowing organizations to efficiently assess vulnerabilities and take informed actions.

“Achieving ISO/IEC recognition for CSAF 2.0 is a tremendous milestone for the global cybersecurity community,” said Omar Santos, co-chair of the OASIS CSAF TC. “This international standardization will drive broader, more consistent adoption of machine-readable vulnerability disclosures and response processes—ultimately helping organizations around the world protect their assets more effectively and streamline their cybersecurity practices. Whether vulnerabilities emerge in legacy environments or in cutting-edge AI solutions, CSAF 2.0 provides a modern framework for effective vulnerability reporting in hardware and software. We look forward to continuing our work within the OASIS CSAF TC to ensure the standard remains at the forefront of global cybersecurity efforts.”

“CISA is pleased that CSAF 2.0 is now recognized as an ISO/IEC standard, a significant achievement in strengthening global cybersecurity resilience. We value our work and ongoing partnership with OASIS,” said Justin Murphy, CISA Vulnerability Disclosure Analyst and co-chair of the OASIS CSAF TC. “CSAF 2.0 enables organizations to respond more effectively to evolving cyber threats across complex environments including critical infrastructure. We encourage and look forward to broader, global adoption of machine-readable standards for vulnerability management efforts.”

CSAF v2.0 was ratified as an OASIS Open Standard in November 2022 and subsequently submitted by OASIS to the ISO/IEC JTC 1 Information Technology body. As ISO/IEC 20153, this International Standard will continue to be maintained and advanced by the OASIS CSAF Technical Committee, which includes representatives of Cisco, Cryptsoft, Cyware, Huawei, Microsoft, Oracle, Red Hat, and others. New members are welcome, and participation in the CSAF TC is open to all through membership in OASIS.

About ISO/IEC JTC 1
ISO-IEC Joint Technical Committee (JTC 1) is a consensus based, voluntary international standards group focusing on information technology (IT). Many hundreds of experts from over 100 countries, represent their nation’s national standards body or national standards committee to mutually develop beneficial guidelines that enhance global trade, while protecting intellectual property. As one of the largest and most prolific technical committees in the international standardization community, ISO/IEC JTC 1 has had direct responsibility for the development of more than 3,500 published ISO standards, with nearly 600 currently under development. Its work in standardization also encompasses 24 subcommittees that make a tremendous impact on the global ICT industry.

About OASIS Open
One of the most respected, nonprofit open source and open standards bodies in the world, OASIS advances the fair, transparent development of open source software and standards through the power of global collaboration and community. OASIS is the home for worldwide standards in AI, emergency management, identity, IoT, cybersecurity, blockchain, privacy, cryptography, cloud computing, urban mobility, and other content technologies. Many OASIS standards go on to be ratified by de jure bodies and referenced in international policies and government procurement.
www.oasis-open.org

Media Inquiries: communications@oasis-open.org

Support for CSAF  

Cyware:
“Cyware is committed to advancing security automation through the adoption of open, machine-readable standards like CSAF. Integrating CSAF into our threat intelligence and security orchestration platforms enables real-time ingestion, normalization, and automated dissemination of vulnerability advisories, enhancing our customers’ ability to rapidly correlate threat data and initiate timely response actions.”
– Avkash Kathiriya, Sr. VP, Research and Innovation, Cyware Labs

Microsoft:
“The designation of the Common Security Advisory Framework (CSAF) as an ISO/IEC 20153 standard marks a significant milestone for the global vulnerability management ecosystem. At Microsoft, we are proud to support this advancement by publishing advisories conforming to the CSAF specification and expanding its adoption across our security practices. CSAF enhances automation, improves interoperability, and accelerates vulnerability response—empowering organizations worldwide to better protect their ecosystems.”
– Bret Arsenault, Corporate Vice President and Chief Cybersecurity Advisor, Microsoft

Disclaimer: CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked or referenced within this press release. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.

Discover the Power of CSAF at Upcoming Workshops

In our technologically driven world, vulnerabilities in hardware and software are an unavoidable reality. No software or hardware is immune to security vulnerabilities. Addressing these “open wounds” in cybersecurity needs automation. This is where the Common Security Advisory Framework (CSAF) emerges as a game-changer.

CSAF is an OASIS open standard designed to streamline the communication and distribution of machine-processable security advisories and mitigation information. It aims to simplify the process by which organizations access and process information about security vulnerabilities and their potential remedies.

As the Chair of CSAF, I have had the honor of working and collaborating with the German Federal Office for Information Security (BSI) the U.S. Cybersecurity and Infrastructure Security Agency (CISA), and numerous industry and government partners in the development and enhancement of CSAF and VEX. This collaboration has been instrumental in creating the future of vulnerability management.

Recognizing the critical importance of modernized vulnerability management, BSI not only promotes the adoption of CSAF but also actively organizes workshops to educate and enable organizations to utilize this framework effectively. As part of the Alliance for Cyber Security (ACS), BSI has scheduled three free workshops from May 14 to May 16, 2024, aimed at strengthening understanding and implementation of CSAF.

We cordially invite you to join the upcoming CSAF workshops, hosted by BSI. These workshops offer a unique opportunity to deepen your understanding of the future of vulnerability disclosure and its critical role in modern cybersecurity.

Participating in these workshops will empower you and your organization with the knowledge to implement CSAF effectively, enhancing your ability to manage vulnerabilities with precision and efficiency. You’ll gain invaluable insights into automated vulnerability management and how CSAF can streamline the communication of security advisories.

Don’t miss this chance to learn from leading experts and network with peers who are equally dedicated to advancing cybersecurity practices.

Register today at: https://workshop.csaf.io

NIEMOpen Initiative for Information Exchange and CSAF Cybersecurity Standard Win OASIS Open Cup Awards

26 January 2023 — OASIS Open, the international open source and standards consortium, announced the winners of the 2022 Open Cup, which recognizes exceptional advancements within the OASIS technical community. The Open Cup for Outstanding New Initiative was awarded to NIEMOpen, a framework for sharing critical data in justice, public safety, emergency management, intelligence, and security sectors. The Open Cup for Outstanding Approved Standard was awarded to Common Security Advisory Framework (CSAF) v2.0, a widely used open standard for automated security advisories and vulnerability reporting. Also announced were the 2022 OASIS Distinguished Contributors, individuals recognized for their significant impact on the open source and open standards communities: Andrea Caccia, Jason Keirstead, and Vasileios Mavoeidis.

Open Cup Recipients

The 2022 Outstanding New Initiative, NIEMOpen, transitioned to an OASIS Open Project from the U.S. Department of Defense in October. A collaborative partnership between private industry and all levels of governmental agencies, the NIEM framework enables the effective and efficient sharing of critical data as currently demonstrated in the justice, public safety, emergency and disaster management, intelligence, and homeland security sectors. Developing and implementing NIEM-based exchanges allows diverse organizations to leverage existing investments in information systems by building the bridges for interoperability at the data level. NIEMOpen was chosen as the winner in the Outstanding New Initiative category that included finalists Infrastructure Data-Plane Function (IDPF) TC and the Value Stream Management Interoperability (VSMI) TC.

CSAF v2.0, the Outstanding Approved Standard Open Cup recipient, makes it possible for cyber defenders to quickly and automatically assess the impact of vulnerabilities and respond in an automated way. This version of CSAF includes support for the Vulnerability Exploitability Exchange (VEX) profile, which is especially helpful in efficiently consuming software bills of materials (SBOM) data, part of the recent U.S. Executive Order on Improving the Nation’s Cybersecurity. 

CSAF v2.0 was chosen from a group of finalists that included:

Distinguished Contributors

Each year, the Distinguished Contributor designation is awarded to OASIS members who have made significant contributions to the advancement of open standards and/or open source projects. This year’s honorees hail from Italy, Canada, and Norway, and exemplify the global commitment and collaborative spirit that is indicative of OASIS members.

Andrea Caccia is an independent consultant and project manager with extensive experience in standard and regulation compliance, electronic invoicing and archiving, data preservation, e-signatures, trust services, blockchain and DLT. Caccia participates in numerous European standardization groups and activities at the European Telecommunications Standards Institute (ETSI), the European Committee for Standardization (CEN), and the International Organization for Standardization (ISO). At OASIS, Caccia is Chair of the Code List Representation TC and is an active member of the Security Algorithms and Methods (SAM), ebXML Messaging Services, and the Universal Business Language (UBL) TCs.

“I am very grateful and honored for this unexpected award from OASIS, where I have always found outstanding and supportive colleagues. I am also very grateful to the OASIS staff, always ready to facilitate our work,” said Caccia.

Jason Keirstead is an IBM Distinguished Engineer and CTO of Threat Management at IBM Security. He has been involved in open technology for decades, making significant contributions to and serving as maintainer of several major open source projects. Keirstead has served on the OASIS Board of Directors since 2018 and currently serves as Co-Chair of the Open Cybersecurity Alliance (OCA), where he enjoys helping to define cybersecurity interoperability. A longtime OASIS member, Keirstead is actively involved in numerous Board Committees and Subcommittees, as well as the Cyber Threat Intelligence (CTI), CSAF, and Collaborative Automated Course of Action Operations (CACAO) for Cyber Security TCs.

“I am both proud and humbled to accept this award. Openness and interoperable standards are what created the internet as we know it, as well as the foundations for all the critical technologies we rely on every day,” said Jason Keirstead. “As technologists, it is important that we continue to build upon that tradition of technology openness and thoughtful collaboration, for the greater good of society – and I feel privileged to have been able to help in those efforts.”

Vasileios Mavroeidis, PhD, a scientist and professor of cybersecurity at the University of Oslo, specializes in the domains of automation and cyber threat intelligence representation, reasoning, and sharing. Mavroeidis is actively involved in European and national research and innovation projects that enhance the cybersecurity capacity of EU authorities and operators of essential services. Since 2021, he has been an appointed member of the European Union Agency for Cybersecurity (ENISA) ad hoc working group on Cyber Threat Landscapes and the Cybersecurity Playbooks task force. Mavroeidis is focused on cybersecurity standardization efforts and has extensive involvement in OASIS. He is currently serving as Chair of the Threat Actor Context (TAC) TC and Secretary of the CACAO TC. In addition, he is engaged in the CTI and the Open Command and Control (OpenC2) TCs.

Mavroeidis said, “First and foremost, I want to thank OASIS for naming me a Distinguished Contributor. It is an award I welcome. I’m a great believer in the value of OASIS standardization activities and their role in enhancing and supporting the European Union’s cybersecurity capacity. My involvement in OASIS has been a rewarding journey, and I look forward to further contributing to the advancement of cybersecurity standardization.”

OASIS congratulates this year’s winners and nominees and thanks them for their willingness to share their time and expertise to help advance OASIS’ work.

About OASIS Open

One of the most respected, nonprofit open source and open standards bodies in the world, OASIS advances the fair, transparent development of open source software and standards through the power of global collaboration and community. OASIS is the home for worldwide standards in cybersecurity, blockchain, privacy, IoT, AI, cryptography, cloud computing, emergency management, and other technologies. Many OASIS standards go on to be ratified by de jure bodies and referenced in international policies and government procurement. 

Media inquiries: communications@oasis-open.org

New Version of CSAF Standard from OASIS Provides Vulnerability Exploitability Exchange and Enhances the Security for Software Bills of Materials (SBOMs) Ecosystem

Boston, MA, USA, 21 November, 2022 – OASIS Open, the international open source and standards consortium, announced the approval of the Common Security Advisory Framework (CSAF) 2.0 as a full OASIS standard, a status that signifies the highest level of ratification. This new version of CSAF includes support for the Vulnerability Exploitability Exchange (VEX) profile, which is especially helpful in efficiently consuming SBOM data. 

The current threat landscape has profoundly changed how systems and people are protected, driving new approaches to cybersecurity, especially around vendor advisories dealing with vulnerability disclosure issues. The OASIS CSAF Technical Committee’s work developing machine readable security advisories makes it possible for cyber defenders to quickly and automatically assess the impact of vulnerabilities and respond in an automated way. 

“Security advisories play a crucial role in securing on-premises and cloud-based assets as they contain critical information about how to remediate vulnerabilities,” said OASIS CSAF chair, Omar Santos, of Cisco. “CSAF v2.0 brings more than machine readable advisories in JSON format; it specifies the distribution mechanism and how new CSAF documents can be discovered and disclosed. It’s the result of an international, industry-wide effort to standardize the reporting of security issues. CSAF enables software producers and consumers to modernize their vulnerability management and response programs.” 

Participation in the OASIS CSAF TC is open to all through membership in OASIS. Providers of products and services that produce, consume, or process security vulnerability remediation information, along with their customers who consume this information, and all other interested parties, are invited to join the group.

The CSAF TC is holding a webinar on Thursday, 1 December at 11am ET, “Using CSAF to Respond to Supply Chain Vulnerabilities at Large Scale.” Speakers include Diane Morris of Cisco, Justin Murphy of the U.S. Cybersecurity and Infrastructure Security Agency (CISA), Omar Santos of Cisco, and Thomas Schmidt of the Federal Office for Information Security Germany (BSI). Attendance is free and open to all. View more specifics here.

Support for CSAF 

Cybeats
“As the number of vulnerabilities exponentially increases, it is paramount to modernize and automate the way organizations exchange information about these risks. Cybeats is proud to be part of OASIS Open and supports the important work of developing CSAF 2.0, as standard of machine readable format. Cybeats is among the first companies to use CSAF 2.0 to generate VEX for SBOMs.”
– Dmitry Raidman, CTO, Cybeats

Oracle
“Oracle is an early adopter of the Common Security Advisory Framework (CSAF) 2.0, an evolution of the Common Vulnerability Reporting Framework (CVRF). CSAF 2.0 further enhances organizations’ capabilities in assessing vulnerabilities to prioritize their patching effort. This new version will support the Vulnerability Exploitability eXchange (VEX) format, which provides a means to determine whether specific vulnerabilities in commonly-used components are exploitable in the context of a given product distribution.”
– Mary Ann Davidson, Chief Security Officer, Oracle

Red Hat 
“Enhancing the security of software supply chains is critical for modern organizations, as complex, multi-footprint digital services take a greater presence in all aspects of society. As a contributor to the CSAF v2.0 framework, we see this effort helping IT security teams to more rapidly and efficiently respond to potential threats via these concepts that modernize and automate security workflows without compromising operations.”
– Pete Allor, Director, Red Hat Product Security

Media inquiries: communications@oasis-open.org

Common Security Advisory Framework v2.0 from CSAF TC approved as revised Committee Specification

OASIS is pleased to announce that Common Security Advisory Framework Version 2.0 from the OASIS Common Security Advisory Framework (CSAF) TC [1] has been approved as an OASIS Committee Specification. This is the third publication of CSAF v2.0 as a Committee Specification.

The Common Security Advisory Framework (CSAF) is a language to exchange Security Advisories formulated in JSON. CSAF v2.0 is the definitive reference for the language which supports creation, update, and interoperable exchange of security advisories as structured information on products, vulnerabilities and the status of impact and remediation among interested parties.

This Committee Specification is an OASIS deliverable, completed and approved by the TC and fully ready for testing and implementation.

The documents and related files are available here:

Common Security Advisory Framework Version 2.0
Committee Specification 03
01 August 2022

Editable source (Authoritative):
https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03.md
HTML:
https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03.html
PDF:
https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03.pdf
JSON schemas:
– Aggregator: https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/schemas/aggregator_json_schema.json
– CSAF: https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/schemas/csaf_json_schema.json
– Provider: https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/schemas/provider_json_schema.json
The changes since the previous publication are marked in:
https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03-DIFF.pdf
Issues resolved after previous publication (CS02) are individually tracked in:
https://docs.oasis-open.org/csaf/csaf/v2.0/cs02/csaf-v2.0-cs02-comment-resolution-log.pdf

Distribution ZIP file
For your convenience, OASIS provides a complete package of the prose specification and related files in a ZIP distribution file. You can download the ZIP file here:
https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03.zip

Members of the CSAF TC [1] approved this specification by Special Majority Vote. The specification had been released for public review as required by the TC Process [2]. The vote to approve as a Committee Specification passed [3], and the document is now available online in the OASIS Library as referenced above.

Our congratulations to the TC on achieving this milestone and our thanks to the reviewers who provided feedback on the specification drafts to help improve the quality of the work.

========== Additional references:

[1] OASIS Common Security Advisory Framework (CSAF) TC
https://www.oasis-open.org/committees/csaf/

[2] Public reviews:
Details of the previous public reviews are listed in:
https://docs.oasis-open.org/csaf/csaf/v2.0/csd02/csaf-v2.0-csd02-public-review-metadata.html

[3] Approval ballot:
https://www.oasis-open.org/committees/ballot.php?id=3721

Common Security Advisory Framework v2.0 from CSAF TC approved as a Committee Specification

OASIS is pleased to announce that Common Security Advisory Framework Version 2.0 from the OASIS Common Security Advisory Framework (CSAF) TC [1] has been approved as an OASIS Committee Specification. This is the second publication of CSAF v2.0 as a Committee Specification.

The Common Security Advisory Framework (CSAF) is a language to exchange Security Advisories formulated in JSON. CSAF v2.0 is the definitive reference for the language which supports creation, update, and interoperable exchange of security advisories as structured information on products, vulnerabilities and the status of impact and remediation among interested parties.

This Committee Specification is an OASIS deliverable, completed and approved by the TC and fully ready for testing and implementation.

The documents and related files are available here:

Common Security Advisory Framework Version 2.0
Committee Specification 02
29 June 2022

Editable source (Authoritative):
https://docs.oasis-open.org/csaf/csaf/v2.0/cs02/csaf-v2.0-cs02.md
HTML:
https://docs.oasis-open.org/csaf/csaf/v2.0/cs02/csaf-v2.0-cs02.html
PDF:
https://docs.oasis-open.org/csaf/csaf/v2.0/cs02/csaf-v2.0-cs02.pdf
JSON schemas:
– Aggregator: https://docs.oasis-open.org/csaf/csaf/v2.0/cs02/schemas/aggregator_json_schema.json
– CSAF: https://docs.oasis-open.org/csaf/csaf/v2.0/cs02/schemas/csaf_json_schema.json
– Provider: https://docs.oasis-open.org/csaf/csaf/v2.0/cs02/schemas/provider_json_schema.json

The changes since the previous publication are marked in:
https://docs.oasis-open.org/csaf/csaf/v2.0/cs02/csaf-v2.0-cs02-DIFF.pdf

Distribution ZIP file

For your convenience, OASIS provides a complete package of the prose specification and related files in a ZIP distribution file. You can download the ZIP file here:
https://docs.oasis-open.org/csaf/csaf/v2.0/cs02/csaf-v2.0-cs02.zip

Members of the CSAF TC [1] approved this specification by Special Majority Vote. The specification had been released for public review as required by the TC Process [2]. The vote to approve as a Committee Specification passed [3], and the document is now available online in the OASIS Library as referenced above.

Our congratulations to the TC on achieving this milestone and our thanks to the reviewers who provided feedback on the specification drafts to help improve the quality of the work.

Additional references

[1] OASIS Common Security Advisory Framework (CSAF) TC
https://www.oasis-open.org/committees/csaf/

[2] Public reviews:
Details of the previous public reviews are listed in:
https://docs.oasis-open.org/csaf/csaf/v2.0/csd02/csaf-v2.0-csd02-public-review-metadata.html
Comment resolution log for most recent public review:
https://docs.oasis-open.org/csaf/csaf/v2.0/csd02/csaf-v2.0-csd02-comment-resolution-log.md
https://docs.oasis-open.org/csaf/csaf/v2.0/csd02/csaf-v2.0-csd02-comment-resolution-log.pdf

[3] Approval ballot:
https://www.oasis-open.org/committees/ballot.php?id=3711

Common Security Advisory Framework v2.0 from CSAF TC approved as a Committee Specification

OASIS is pleased to announce that Common Security Advisory Framework Version 2.0 from the OASIS Common Security Advisory Framework (CSAF) TC [1] has been approved as an OASIS Committee Specification.

The Common Security Advisory Framework (CSAF) is a language to exchange Security Advisories formulated in JSON. CSAF v2.0 is the definitive reference for the language which supports creation, update, and interoperable exchange of security advisories as structured information on products, vulnerabilities and the status of impact and remediation among interested parties.

This Committee Specification is an OASIS deliverable, completed and approved by the TC and fully ready for testing and implementation.

The prose specifications and related files are available here:

Common Security Advisory Framework Version 2.0
Committee Specification 01
12 November 2021

Editable source (Authoritative):
https://docs.oasis-open.org/csaf/csaf/v2.0/cs01/csaf-v2.0-cs01.md
HTML:
https://docs.oasis-open.org/csaf/csaf/v2.0/cs01/csaf-v2.0-cs01.html
PDF:
https://docs.oasis-open.org/csaf/csaf/v2.0/cs01/csaf-v2.0-cs01.pdf
JSON schemas:
Aggregator: https://docs.oasis-open.org/csaf/csaf/v2.0/cs01/schemas/aggregator_json_schema.json
CSAF: https://docs.oasis-open.org/csaf/csaf/v2.0/cs01/schemas/csaf_json_schema.json
Provider: https://docs.oasis-open.org/csaf/csaf/v2.0/cs01/schemas/provider_json_schema.json

Distribution ZIP file

For your convenience, OASIS provides a complete package of the prose specification and related files in a ZIP distribution file. You can download the ZIP file here:
https://docs.oasis-open.org/csaf/csaf/v2.0/cs01/csaf-v2.0-cs01.zip

Members of the CSAF TC [1] approved this specification by Special Majority Vote. The specification had been released for public review as required by the TC Process [2]. The vote to approve as a Committee Specification passed [3], and the document is now available online in the OASIS Library as referenced above.

Our congratulations to the TC on achieving this milestone and our thanks to the reviewers who provided feedback on the specification drafts to help improve the quality of the work.

Additional references

[1] OASIS Common Security Advisory Framework (CSAF) TC
https://www.oasis-open.org/committees/csaf/

[2] Public review timeline:
Details of the public reviews are listed in:
https://docs.oasis-open.org/csaf/csaf/v2.0/csd01/csaf-v2.0-csd01-public-review-metadata.html
Comment resolution log for most recent public review:
https://docs.oasis-open.org/csaf/csaf/v2.0/csd01/csaf-v2.0-csd01-comment-resolution-log.md

[3] Approval ballot:
https://www.oasis-open.org/committees/ballot.php?id=3666

CSAF Common Vulnerability Reporting Framework (#CVRF) V1.2 is now a Committee Specification

We are pleased to announce the publication of CSAF Common Vulnerability Reporting Framework (CVRF) Version 1.2, the first approved specification from the members of the OASIS Common Security Advisory Framework (CSAF) TC.

CSAF Common Vulnerability Reporting Framework (CVRF) Version 1.2
Committee Specification 01
13 September 2017

CVRF is a language to exchange Security Advisories and provide for greater interoperability among products by ensuring that machine-readable security advisories can be produced and consumed much more broadly. The specification builds on the Common Vulnerability Reporting Framework (CVRF) 1.1 which was initiated by ICASI, the Industry Consortium for Advancement of Security on the Internet and contributed to OASIS.

For more information on CVRF and the CSAF TC, see the press release at https://www.oasis-open.org/news/pr/oasis-advances-standard-for-automated-disclosure-of-cybersecurity-vulnerability-issues

This is an OASIS deliverable, completed and approved by the TC and fully ready for testing and implementation.

The prose specifications and related files are available here:

PDF (Authoritative):
http://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/cs01/csaf-cvrf-v1.2-cs01.pdf

HTML:
http://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/cs01/csaf-cvrf-v1.2-cs01.html

Editable source:
http://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/cs01/csaf-cvrf-v1.2-cs01.docx

XML schemas:
http://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/cs01/schemas/

Distribution ZIP file

For your convenience, OASIS provides a complete package of the prose specification and related files in a ZIP distribution file. You can download the ZIP file here:

http://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/cs01/csaf-cvrf-v1.2-cs01.zip

Members of the CSAF TC [1] approved this specification by Special Majority Vote. The specification had been released for public review as required by the TC Process [2]. The vote to approve as a Committee Specification passed [3], and the document is now available online in the OASIS Library as referenced above.

Our congratulations to the TC on achieving this milestone and our thanks to the reviewers who provided feedback on the specification drafts to help improve the quality of the work.

========== Additional references:

[1] OASIS Common Security Advisory Framework (CSAF) TC
https://www.oasis-open.org/committees/csaf/

[2] Public reviews:
– 30-day public review, 21 June 2017:
https://lists.oasis-open.org/archives/members/201706/msg00007.html
– Comment resolution log:
http://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/csprd01/csaf-cvrf-v1.2-csprd01-comment-resolution-log.txt

[3] Approval ballot:
https://www.oasis-open.org/committees/ballot.php?id=3121

OASIS Awards 2017 Open Standards Cup to TOSCA for Cloud Portability and to CSAF for Cybersecurity Disclosure

14 August 2017 – TOSCA (Topology and Orchestration Specification for Cloud Applications) and CSAF (Common Security Advisory Framework) were both awarded the 2017 Open Standards Cup by the OASIS international consortium in recognition of exceptional advancements within the IT community.

Named as Outstanding Approved Standard, TOSCA addresses portability and operational management of cloud applications and services across their entire lifecycle. By defining the interoperable description of cloud-hosted services and applications, TOSCA enables automated management across cloud providers, regardless of underlying platform or infrastructure. The OASIS TOSCA Technical Committee is co-chaired by John Crandall of Brocade Communications and Paul Lipton of CA Technologies.

“We have tremendous technical leaders in the TOSCA TC,” said Lipton, accepting the Open Standards Cup award on behalf of the group. “Every day of the week, there’s somebody doing something with TOSCA and that explains why so many open source and commercial implementations already exist for the standard.”

Named as Outstanding New Initiative, CSAF defines a standard format for vendors to disclose cybersecurity vulnerabilities. CSAF enables greater interoperability among products, ensuring that structured, machine-readable security advisories can be produced and consumed much more broadly. The OASIS CSAF Technical Committee is chaired by Omar Santos of Cisco.

“CSAF started in ICASI, an organization that is not a standards body. ICASI supported CSAF’s transition to OASIS, which brought a great deal of new interest and support for our work,” said Santos at the presentation ceremony. “This award raises the bar for us to accomplish great things.”

Finalists in the Approved Standard category include the DocBook publishing standard, KMIP key management protocol, Business Document Naming and Design Rules, and XLIFF localization format. Finalists in the New Initiative category include OSLC Lifecycle Integration for Domains and MQTT (rechartered).

About OASIS

OASIS is a non-profit, international consortium that drives the development, convergence and adoption of open standards for the global information society. OASIS promotes industry consensus and produces worldwide standards for content technologies, digital experiences, security, privacy, cloud computing, IoT, and other areas. OASIS open standards offer the potential to lower cost, stimulate innovation, grow global markets, and protect the right of free choice of technology. OASIS members broadly represent the marketplace of public and private sector technology leaders, users, and influencers. The consortium has more than 5,000 participants representing over 600 organizations and individual members in 65+ countries. http://www.oasis-open.org # # # For more information, please contact Carol Geyer, Senior Director, at carol.geyer@oasis-open.org or +1.941.284.0403.

Invitation to comment on #CSAF Common Vulnerability Reporting Framework (#CVRF) v1.2 – ends July 20th

We are pleased to announce that CSAF Common Vulnerability Reporting Framework (CVRF) Version 1.2, the first release from the OASIS Common Security Advisory Framework (CSAF) TC, is now available for public review and comment.

CVRF is a language to exchange Security Advisories and provide for greater interoperability among products by ensuring that machine-readable security advisories can be produced and consumed much more broadly. The specification builds on the Common Vulnerability Reporting Framework (CVRF) 1.1 which was initiated by ICASI, the Industry Consortium for Advancement of Security on the Internet and contributed to OASIS.

For more information on CVRF and the CSAF TC, see the press release at https://www.oasis-open.org/news/pr/oasis-advances-standard-for-automated-disclosure-of-cybersecurity-vulnerability-issues

The documents and related files are available at:

CSAF Common Vulnerability Reporting Framework (CVRF) Version 1.2
Committee Specification Draft 01 / Public Review Draft 01
31 May 2017

PDF (Authoritative):
http://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/csprd01/csaf-cvrf-v1.2-csprd01.pdf

HTML:
http://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/csprd01/csaf-cvrf-v1.2-csprd01.html

Editable source:
http://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/csprd01/csaf-cvrf-v1.2-csprd01.docx

XML schemas:
http://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/csprd01/schemas/

For your convenience, OASIS provides a complete package of the prose document and any related files in ZIP distribution files. You can download the ZIP file at:

http://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/csprd01/csaf-cvrf-v1.2-csprd01.zip

Public Review Period:

OASIS and the CSAF TC value your feedback. We solicit input from developers, users and others, whether OASIS members or not, for the sake of improving the interoperability and quality of its technical work.

The public review starts 21 June 2017 at 00:00 UTC and ends 20 July 2017 at 23:59 UTC.

Comments may be submitted to the TC by any person through the use of the OASIS TC Comment Facility. For instructions, see:

https://www.oasis-open.org/committees/comments/index.php?wg_abbrev=csaf

Comments submitted by TC non-members for this work and for other work of this TC are publicly archived and can be viewed at:

https://lists.oasis-open.org/archives/csaf-comment/

All comments submitted to OASIS are subject to the OASIS Feedback License, which ensures that the feedback you provide carries the same obligations at least as the obligations of the TC members. In connection with this public review, we call your attention to the OASIS IPR Policy [1] applicable especially [2] to the work of this technical committee. All members of the TC should be familiar with this document, which may create obligations regarding the disclosure and availability of a member’s patent, copyright, trademark and license rights that read on an approved OASIS specification.

OASIS invites any persons who know of any such claims to disclose these if they may be essential to the implementation of the above specification, so that notice of them may be posted to the notice page for this TC’s work.

Additional information about the specification and the CSAF TC can be found at the TC’s public home page:

https://www.oasis-open.org/committees/csaf/

========== Additional references:

[1] http://www.oasis-open.org/who/intellectualproperty.php

[2] http://www.oasis-open.org/committees/csaf/ipr.php
https://www.oasis-open.org/policies-guidelines/ipr#Non-Assertion-Mode
Non-Assertion Mode

Call for Participation: OASIS Common Security Advisory Framework (CSAF) TC

A new OASIS technical committee is being formed. The OASIS Common Security Advisory Framework (CSAF) Technical Committee (TC) has been proposed by the members of OASIS listed in the charter below. The TC name, statement of purpose, scope, list of deliverables, audience, IPR mode and language specified in this proposal will constitute the TC’s official charter. Submissions of technology for consideration by the TC, and the beginning of technical discussions, may occur no sooner than the TC’s first meeting.

The eligibility requirements for becoming a participant in the TC at the first meeting are:

(a) you must be an employee or designee of an OASIS member organization or an individual member of OASIS, and

(b) you must join the Technical Committee, which members may do by using the Roster “join group” link on the TC’s web page at [a].

To be considered a voting member at the first meeting:

(a) you must join the Technical Committee at least 7 days prior to the first meeting (on or before 10 November 2016) and

(b) you must attend the first meeting of the TC, at the time and date fixed below (16 November 2016).

Participants also may join the TC at a later time. OASIS and the TC welcomes all interested parties.

Non-OASIS members who wish to participate may contact us about joining OASIS [b]. In addition, the public may access the information resources maintained for each TC: a mail list archive, document repository and public comments facility, which will be linked from the TC’s public home page at [c].

Please feel free to forward this announcement to any other appropriate lists. OASIS is an open standards organization; we encourage your participation.

———-

[a] https://www.oasis-open.org/apps/org/workgroup/csaf/

[b] See http://www.oasis-open.org/join/

[c] http://www.oasis-open.org/committees/csaf/

———-

CALL FOR PARTICIPATION

OASIS Common Security Advisory Framework (CSAF) Technical Committee Charter

The charter for this TC is as follows.

Section 1: TC Charter

(1)(a) TC Name

OASIS Common Security Advisory Framework (CSAF) Technical Committee

(1)(b) Statement of Purpose

The current threat landscape combined with the emergence of the Internet of Things have profoundly changed how we protect our systems and people, driving us to think about a new approach to cybersecurity, especially around vendor advisories dealing with vulnerability disclosure issues. The purpose of the CSAF Technical Committee is to standardize existing practice in structured machine-readable security vulnerability-related advisories and further refine those standards over time.

The TC will base its efforts on the Common Vulnerability Reporting Framework (CVRF) specification originally developed by the Industry Consortium for Advancement of Security on the Internet (ICASI). ICASI intends to contribute CVRF to the TC. Prior to creation of the TC, the CVRF standard has been adopted by several technology vendors and MITRE, which produce information in the CVRF format. Additionally, a number of organizations are consuming information produced in the CVRF format. By building upon the existing CVRF standard, the TC can offer immediate value and quickly support future development to improve the interoperability and utility of the framework in support of providing structured machine-readable security advisories.

(1)(c) Scope

The TC will use CVRF 1.1 as the basis for creating OASIS Standards Track Work Products. One important consideration will be attempting to maintain backwards compatibility with CVRF 1.1, where possible, by carefully considering changes to the input specifications and minimizing the impact to existing implementations. Another important consideration will be to ensure that the specification provides for sufficient interoperability to allow any consuming application to reliably process vulnerability-related remediation advisories from multiple sources without special semantic handling for each source.
The TC will develop format specifications for structured, machine-readable security vulnerability-related security advisories under the OASIS TC process, with the goal of submitting them at the appropriate time to the membership of the organization for consideration as an OASIS Standard. Other contributions will be accepted for consideration without any prejudice or restrictions and evaluated based on technical merit insofar as they conform to this charter.

(1)(d) Deliverables

The TC will make substantive additions and other changes to the CVRF input specification to correct errors and evolve capabilities based on requirements and capabilities identified by OASIS TC members. The TC will rename the framework to more closely align to the primary use (e.g. Common Security Advisory Framework – CSAF). Deliverables will include a major revision of the framework. In addition to the specification deliverables, the TC may deliver supporting documentation and open source tooling on an ongoing basis in support of the TC’s published standard(s). The TC expects to produce a major revision of the framework within 18 months of its first meeting.

(1)(e) IPR Mode

This TC will operate under the Non-Assertion IPR mode (https://www.oasis-open.org/policies-guidelines/ipr#Non-Assertion-Mode) as defined in Section 10.3 of the OASIS IPR Policy document (https://www.oasis-open.org/policies-guidelines/ipr).

(1)(f) Audience

The anticipated audience includes providers of products and services that produce, consume, or process security vulnerability remediation information, along with their customers who consume this information.

(1)(g) Language

The TC business will be conducted in English. The output documents will be written in (US) English. Translations to other languages may be made based on interest and ability.

Section 2: Additional Information

(2)(a) Identification of Similar Work

The Common Vulnerability Reporting Framework (CVRF) is a standard originally created by the Industry Consortium for Advancement of Security on the Internet (ICASI). CVRF is an XML-based language that enables different stakeholders across different organizations to share critical vulnerability remediation information in a single format, speeding up information exchange and digestion. The current version is CVRF Version 1.1 was released in May 2012.

There are a number of older advisory format efforts, most of which are defunct. The TC will investigate prior work for potential incorporation. The following are a few examples:

* CAIF: http://www.caif.info/draft-weimer-goebel-caif-requirements.html
* OASIS AVDL: https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=avdl
* VULDEF: http://jvnrss.ise.chuo-u.ac.jp/jtg/vuldef/index.en.html
* EISPP Common Advisory Format: http://www.cert-ist.com/eispp/documents.htm#common_format

(2)(b) First TC Meeting

The first TC meeting will be held on 16 November 2016 at 17:00 UTC / 1:00 PM EDT / 10:00 AM PDT via teleconference. The teleconference will be hosted by Cisco Systems.

(2)(c) Ongoing Meeting Schedule

Monthly teleconferences will be held until the initial objectives outlined in section (1)(d) have been achieved. The exact schedule for these meetings has not yet been determined. After the initial objectives have been met, periodic meetings will be held to review the future initiatives of the TC. These will happen no longer than one year apart.

(2)(d) TC Proposers

Omar Santos, os@cisco.com (Cisco)
Mark-David, McLaughlin marmclau@cisco.com (Cisco)
Lou Ronnau, lronnau@cisco.com (Cisco)
Troy Fridley, trfridle@cisco.com (Cisco)
Chok Poh, Chok.Poh@oracle.com (Oracle)
Feng Cao, feng.cao@oracle.com (Oracle)
Bruce Monroe, bruce.monroe@intel.com (Intel)
Brian Willis, brian.willis@intel.com (Intel)
Richard Struse, richard.struse@hq.dhs.gov (US Dept. of Homeland Security)
Harold Booth, harold.booth@nist.gov (NIST)
Vincent Danen, vdanen@redhat.com (RedHat)
Art Manion, amanion@cert.org (CERT/CC)
Bret Jordan, bret_jordan@symantec.com (Symantec)
Karen Scarfone, karen@scarfonecybersecurity.com (Individual)

(2)(e) Primary Representatives’ Support

“I, Abhijit Kolhatkar (akolhatk@cisco.com), as Cisco Systems’ Primary Representative to OASIS, confirm our support for the OASIS Common Security Advisory Framework (CSAF) Technical Committee proposed charter and the participation of our organization’s co-proposers as named above.”

“I, Elaine Newton (enewton@nist.gov), as the NIST Primary Representative to OASIS, confirm our support for the OASIS Common Security Advisory Framework (CSAF) Technical Committee charter and the participation of our co-proposer named in the draft proposal for the new TC.”

“I, Kent Landfield (kent.b.landfield@intel.com), as the Intel Corporation’s Primary Representative to OASIS, confirm our support for the OASIS Common Security Advisory Framework (CSAF) Technical Committee charter and the participation of our co-proposers named above.”

“I, Mark Little (mlittle@redhat.com), as Red Hat’s Primary Representative to
OASIS, confirm our support for the OASIS Common Security Advisory Framework (CSAF) Technical Committee proposed charter and the participation of our organization’s co-proposer, Vincent Danen.”

I, Art Manion (amanion@cert,org), as the CERT/CC and Software Engineering Institute (SEI) Primary Representative to OASIS, confirm our support for the OASIS Common Security Advisory Framework Technical Committee proposed charter and the participation of our organization’s co-proposer as named above.

“I, Martin Chapman (martin.chapman@oracle.com), as Oracle’s Primary Representative to OASIS, confirm our support for the OASIS Common Security Advisory Framework (CSAF) Technical Committee proposed charter and the participation of our organization’s co-proposers as named above.”

“I, Juan Gonzalez (juan.m.gonzalez@hq.dhs.gov), as DHS Office of Cybersecurity and Communications Primary Representative to OASIS, confirm our support for the OASIS Common Security Advisory Framework Technical Committee proposed charter and the participation of our organization’s co-proposer Rich Struse.”

“I, Bret Jordan (bret_jordan@symantec.com), as Symantec’s Primary Representative to OASIS, confirm our support for the OASIS Common Security Advisory Framework (CSAF) Technical Committee proposed charter and the participation of our organization’s co-proposer as named above.”

(2)(f) TC Convener

Omar Santos
os@cisco.com
Principal Engineer, PSIRT
Cisco Systems, Inc.

(2)(g) OASIS Member Section

The TC does not anticipate requesting affiliation with any Member Section at this time.

(2)(h) Anticipated Contributions

The Common Vulnerability Reporting Framework (CVRF) Version 1.1 is expected to by contributed by ICASI (The Industry Consortium for Advancement of Security on the Internet). The current version of CVRF can be found at http://www.icasi.org/the-common-vulnerability-reporting-framework-cvrf-v1-1/.

(2)(i) FAQ Document

N/A

(2)(j) Work Product Titles and Acronyms

* Common Vulnerability Reporting Framework (CVRF) Version 1.1
* Industry Consortium for Advancement of Security on the Internet (ICASI)
* Intellectual Property Rights (IPR)
* Organization for the Advancement of Structured Information Standards (OASIS)
* Technical Committee (TC)

No results with the selected filters