CSAF: Common Security Advisory Framework
Already a member?
Access the CSAF community workspace here
Advancing cybersecurity through standardized, automated vulnerability management.
The OASIS Common Security Advisory Framework (CSAF) Technical Committee (TC) is responding to a rapidly evolving threat landscape that has profoundly changed how systems and people are protected. As cybersecurity threats grow more sophisticated, new approaches are needed, particularly in vulnerability disclosure and security advisories. The CSAF TC is at the forefront of this effort, working to standardize machine-readable and automatable security advisories that enable cyber defenders to swiftly assess vulnerabilities and automate their response. By refining these standards over time, CSAF ensures that organizations can efficiently share, process, and act on critical security information, strengthening defenses and staying ahead of emerging threats.
Security advisories are often presented as static documents, such as websites, HTML files, or PDFs, distributed by vendors or organizations. These advisories are designed for human consumption, making automation difficult.
As the number of security vulnerabilities discovered and disclosed continues to increase, driven by greater insights into the supply chain through Software Bill of Materials (SBOMs) and other artifacts, as well as improvements in our tools, automation becomes critical.
CSAF has taken on the important task of specifying a standard for machine-readable and automatable security advisories. The release of CSAF V2.0 brings more than just machine-readable advisories in JSON format; it also specifies the distribution mechanism and how new CSAF documents can be discovered and disclosed.
The VEX (Vulnerability Exchange) profile within a CSAF document addresses one of the major challenges when introducing SBOMs. It allows vendors to inform users, customers, and consumers that a product may not be affected by a third-party software vulnerability. For example, if a vulnerable component has been removed or remediated, the VEX profile communicates this clearly. It also enables responses to false positives generated by security scanners.
CSAF Sponsors
TC Leadership
TC Chair:
Stefan Hagen
Justin Murphy, DHS/CISA
Omar Santos, Cisco Systems
Staff Contact:
Kelly Cullinane
“Security advisories play a crucial role in securing on-premises and cloud-based assets as they contain critical information about how to remediate vulnerabilities. CSAF v2.0 brings more than machine readable advisories in JSON format; it specifies the distribution mechanism and how new CSAF documents can be discovered and disclosed. It’s the result of an international, industry-wide effort to standardize the reporting of security issues. CSAF enables software producers and consumers to modernize their vulnerability management and response programs.”
Omar Santos, CSAF Chair, Cisco
“Oracle is an early adopter of the Common Security Advisory Framework (CSAF) 2.0, an evolution of the Common Vulnerability Reporting Framework (CVRF). CSAF 2.0 further enhances organizations’ capabilities in assessing vulnerabilities to prioritize their patching effort. This new version will support the Vulnerability Exploitability eXchange (VEX) format, which provides a means to determine whether specific vulnerabilities in commonly-used components are exploitable in the context of a given product distribution.”
Mary Ann Davidson, Chief Security Officer, Oracle
“Enhancing the security of software supply chains is critical for modern organizations, as complex, multi-footprint digital services take a greater presence in all aspects of society. As a contributor to the CSAF v2.0 framework, we see this effort helping IT security teams to more rapidly and efficiently respond to potential threats via these concepts that modernize and automate security workflows without compromising operations.”
Pete Allor, Director, Product Security, Red Hat
Frequently Asked Questions
The Common Security Advisory Framework (CSAF) is the definitive reference for the language which supports creation, update, and interoperable exchange of security advisories as structured information on products, vulnerabilities and the status of impact and remediation among interested parties. You can access the CSAF 2.0 standard here and visit visit https://www.csaf.io for additional information, tools, implementation resources, and community updates.
The current threat landscape combined with the emergence of the Internet of Things have profoundly changed how we protect our systems and people, driving us to think about a new approach to cybersecurity, especially around vendor advisories dealing with vulnerability disclosure issues. CSAF plays a crucial role in the cybersecurity arena since it allows stakeholders to automate the creation and consumption of security vulnerability information and remediation.
· Members of the CSAF TC will have the opportunity to contribute directly to the development and evolution of important cybersecurity standards that are widely adopted in the industry.
· By contributing to the standardization of structured, machine-readable vulnerability advisories, you can help ensure more efficient remediation processes, reducing time and effort spent on manual tasks.
· Joining the CSAF TC provides the opportunity to collaborate with leading cybersecurity vendors, organizations, and experts who are dedicated to improving the security landscape. This collaboration fosters innovation and allows you to stay at the forefront of cybersecurity trends.
Participation in the OASIS CSAF TC is open to all through membership in OASIS. Providers of products and services that produce, consume, or process security vulnerability remediation information, along with their customers who consume this information, and all other interested parties, are invited to join the group.
Participation in the CSAF TC does not require a significant time commitment. Members typically meet once a month for an hour and collaborate extensively via email and shared documents. If your availability is limited and you prefer not to affect quorum, you have the option to join as an Observer. Observers can stay informed and contribute without the obligation of full participation, though OASIS membership is still required. View more info on committee participation [here].
New Members Welcome
Whether you want to actively contribute in decision-making or just observe progress from the inside, you will need to be an OASIS member.
If your employer is already on our current member list, submit this request form to be added to the TC Roster. If not, find out how to join OASIS.
Non-members may monitor the mailing list archives online, view approved documents, and provide feedback to our comments list. Contact Us for more information.