Until now, security advisories have mostly been published as web pages or PDFs, each vendor with its own structure. Anyone operating many products has to read them individually and match them manually against their own inventory. CSAF replaces this with structured data. Version 2.0 has been an OASIS standard since November 18, 2022, and has also been published as the international standard ISO/IEC 20153:2025 since February 2025. The German BSI (Federal Office for Information Security) actively promotes CSAF and describes the requirements in Technical Guideline TR-03191.
How is a CSAF document structured?
A CSAF document is a JSON file with three core parts: information about the document and publisher, a product tree with all affected products and versions, and the vulnerabilities with CVE ID, rating, and remediation. CSAF 2.0 defines five profiles:
- CSAF Base as the basic framework,
- Security Advisory for classic security advisories,
- VEX for statements on whether a product is actually affected by a vulnerability,
- Informational Advisory for advisories without a specific vulnerability, for example on configurations,
- Security Incident Response for the response to a security incident.
What is VEX?
VEX stands for Vulnerability Exploitability eXchange. For each combination of product and vulnerability, a VEX document states whether the product is affected (known_affected), not affected (known_not_affected), already fixed (fixed), or still under investigation (under_investigation). A justification is mandatory for "not affected", and an action statement for "affected". This is particularly valuable together with an SBOM: the bill of materials shows that a vulnerable library is included, and VEX states whether the vulnerability can be exploited at all in the specific product.
How are CSAF documents distributed?
The standard defines roles with increasing requirements: publisher, provider, trusted provider, lister, and aggregator. A provider makes its documents available at a defined location so that tools can retrieve them automatically. An aggregator collects documents from at least two independent publishers.
In practice for SMEs and municipalities
- Ask when purchasing: Does the vendor of your firewall, line-of-business application, or control system publish security advisories as CSAF? The BSI sees the importance of CSAF growing in connection with the Cyber Resilience Act and NIS2.
- Use tools: Vulnerability and asset management solutions that ingest CSAF match advisories automatically against the inventory.
- Publish yourself: If you manufacture software or devices, you can provide your advisories directly as CSAF as part of coordinated disclosure.
Limitations
CSAF is only as good as the publisher's data. Incorrect version information in the product tree leads to false matches. The successor version CSAF 2.1 is still a draft; version 2.0 remains authoritative until further notice.
How TOMORIS relates
GRID.scout evaluates vulnerability findings in context and translates them into prioritized measures that are tracked in vulnerability management.