SBOM vs VEX: What's the Difference?

An inventory is not a risk assessment, and an optional communication format is not a statutory requirement. Separating these concepts helps teams prepare accurate documentation without inventing VEX obligations.

The FDA's February 3, 2026 premarket cybersecurity guidance discusses SBOMs and vulnerability assessment, not VEX. This comparison explains how an SBOM and optional VEX statements can support a vulnerability management process.

Why the SBOM vs VEX distinction matters

Section 524B requires an SBOM for cyber devices, a postmarket monitoring and vulnerability management plan, and cybersecurity processes and procedures including updates and patches. It does not require VEX.

The FDA premarket cybersecurity guidance, February 3, 2026, recommends a machine-readable SBOM, software support and end-of-support information, identification of all known vulnerabilities including CISA KEV entries, and risk assessment and controls. It never mentions VEX. VEX can communicate part of that analysis but does not replace it.

At a glance

What an SBOM actually is

An SBOM identifies software components and their relationships. Typical fields include supplier, component name, version, identifiers, and dependencies. It is not a conclusion about exploitability or risk.

The FDA recommends a machine-readable SBOM and references NTIA's October 2021 SBOM framing. Separately, CISA's July 29, 2026 Minimum Elements update expands the earlier baseline, including author signature, SBOM version, and component hash. Do not describe the older seven-field list as the complete 2026 minimum elements or imply the later update is incorporated into the February guidance.

For inventory details, see our medical device SBOM guide and CycloneDX vs SPDX comparison.

What a VEX actually is

VEX communicates a statement author's assessment using four statuses:

• not_affected: the vulnerability does not affect the identified product. CISA says a justification SHOULD be given; otherwise an impact statement MUST be provided.
• affected: the vulnerability affects the product. An action statement MUST be provided.
• fixed: the identified product versions contain the fix. An upstream patch does not make an older shipped vulnerable version fixed.
• under_investigation: a final assessment has not yet been made.

A manufacturer or third party can author VEX. Product identifiers can stand alone; an SBOM is not a prerequisite. See the VEX document guide for all five not_affected justifications.

A compensating control does not automatically justify not_affected. In particular, inline_mitigations_already_exist means built-in protections fully prevent exploitation through known attack vectors and cannot be subverted, configured, or disabled.

How they work together

The following is an illustrative internal workflow, not a description of FDA review or a promise of acceptance:

SBOM -> vulnerability matching -> product-specific risk assessment
                             -> optional VEX communication
                             -> controls, remediation, and monitoring

1. Identify components and software versions.
2. Gather known vulnerabilities from scanning, advisories, disclosure, and KEV sources.
3. Assess all known vulnerabilities and document product-specific risks and controls.
4. Optionally communicate status through VEX, retaining evidence and remediation records.

See VEX Document Guide for Medical Devices: Statuses and Mistakes. A completed workflow does not guarantee the adequacy of a submission.

Why you can't substitute one for the other

An SBOM is not a vulnerability assessment. VEX is not an inventory and cannot replace a statutory SBOM obligation. But that does not mean every SBOM must be accompanied by VEX: assessment results can be documented in other ways.

VEX without an SBOM is valid. Its product and vulnerability identifiers provide the reference context. When both documents are used, consistent identifiers or explicit mappings improve traceability.

How the FDA actually reads your SBOM and VEX

See also: What Is MedTech? MedTech vs Medical Device vs Life Sciences, 8 FDA Cybersecurity Documentation Gaps to Review, and CVSS Score for Medical Devices: How to Calculate and Use It.

Do not assume a universal reviewer workflow or line-by-line VEX cross-check. Instead, organize evidence around the guidance's recommendations: a machine-readable inventory, support information, known-vulnerability identification, risk assessment, and controls.

If including VEX, identify the product versions and connect statements to the underlying evidence. A status label alone does not establish acceptable residual risk or resolve a deficiency.

Use the four-status VEX crosswalk to FDA cybersecurity guidance to see which evidence can support not_affected, affected, fixed, and under_investigation statements. The crosswalk does not turn VEX into a required submission format.

Refresh cadence - the silent killer

Keep inventory aligned with the software supplied and reassess vulnerabilities as new information becomes available. Monthly VEX review may be a useful internal suggestion, not a regulatory minimum. Set escalation and response targets based on risk rather than only CVSS.

CISA's When to Issue VEX Information, November 2023, describes publication timing as a business decision. Coordinate relevant submission updates through your regulatory process rather than assuming every new CVE requires an unsolicited VEX amendment.

SBOM and VEX format options

There is no FDA two-format VEX rule, mandatory SBOM/VEX format pairing, or requirement to deliver both embedded and standalone VEX. Choose based on recipient needs and tooling, and validate against the selected schema.

How Blue Goat approaches this

We help connect component inventory, vulnerability analysis, controls, and optional VEX communication. Our focus is product-version traceability and evidence, not treating VEX as a mandatory submission exhibit. Explore FDA premarket cybersecurity services and GoatWatch for ongoing vulnerability tracking.

FAQ

Do I need both an SBOM and a VEX for the FDA?

Section 524B requires an SBOM for cyber devices. The FDA recommends vulnerability assessment, but its February 3, 2026 guidance never mentions VEX. VEX is optional.

Can VEX statements live inside my SBOM?

CycloneDX supports embedded vulnerability analysis or separate documents. SPDX 3.0's Security profile supports assessment information; SPDX 2.x lacks native VEX. There is no FDA requirement to ship both embedded and standalone VEX.

Is a vulnerability scan report the same as a VEX?

No. A scan identifies potential matches. VEX communicates an author's assessment of whether identified products are affected. Neither alone replaces risk assessment and control documentation.

What happens if a new CVE lands after I submit?

Assess its applicability and risk, update controls and status records as appropriate, and coordinate any necessary submission communication through your regulatory process. Consider all known vulnerabilities, not only those above a CVSS threshold.

Does this apply to non-FDA submissions like EU MDR?

The distinction between inventory, assessment, and communication remains useful. Determine applicable regional requirements separately; do not infer a VEX obligation from this workflow.

Can I publish VEX without an SBOM?

Yes. CISA's VEX model does not require an SBOM, and third parties may author statements. Clearly identify the products and vulnerabilities covered.

Sources & primary references

• FDA premarket cybersecurity guidance, February 3, 2026
• CISA Minimum Requirements for VEX, April 2023
• CISA 2026 SBOM Minimum Elements, July 29, 2026
• CISA When to Issue VEX Information, November 2023

Need help building this?

Use the VEX assessment worksheet to record your assessment. It produces a printable worksheet, not a machine-readable VEX document.

• Read the VEX guide.
• Review VEX Document Guide for Medical Devices: Statuses and Mistakes.
• Explore medical device SBOM services for FDA premarket submissions.