VEX Resources for Medical Device Teams: Guides and Mistakes

A vulnerability match starts an investigation; it does not finish one. Teams still need to establish which device versions contain the relevant code, whether exploitation is possible, and what the finding means for the device's intended use.

The FDA's February 3, 2026 premarket cybersecurity guidance recommends identifying known vulnerabilities, assessing their risks, and documenting controls. It does not mention VEX. A status label cannot establish patient safety or acceptance of residual risk.

These resources answer different questions. The guide explains statements and evidence, the comparison separates VEX from an SBOM, and the mistakes article addresses assessment and documentation errors. Use the reading path below without treating an optional format as a submission requirement.

Why This Matters

Assessment quality matters more than the presence of a VEX file. An unsupported not_affected statement can hide an unresolved question. Calling a shipped version fixed when it is still awaiting an update misrepresents the device.

The FDA guidance, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions, issued February 3, 2026, recommends vulnerability identification, risk assessment, and controls. Section 524B requires an SBOM for covered cyber-device submissions, along with cybersecurity processes and a postmarket vulnerability management plan. Neither makes VEX mandatory.

CISA's Minimum Requirements for Vulnerability Exploitability eXchange identifies four statuses: not_affected, affected, fixed, and under_investigation. They communicate different conclusions, not four levels of clinical risk. Device risk management requires its own analysis, supported by relevant processes such as ISO 14971 and IEC 81001-5-1.

Which VEX Resource Should You Read First?

Start with the question you need to answer. Each resource has a distinct purpose.

Start with the VEX document guide

Use the guide to prepare or review statements. It distinguishes CISA's status-specific requirements from useful supporting records and explains why an ordinary configurable compensating control does not automatically establish not_affected.

Separate SBOM inventory from VEX assessment

Read the comparison when software, quality, or regulatory teams treat the documents as interchangeable. An SBOM identifies components; VEX communicates an assessment about a vulnerability and an identified product. VEX can be used without an SBOM, including statements authored by third parties.

Review common assessment mistakes

See also: CISA KEV Catalog: Prioritize Device Risk, SBOM for SaMD and Cloud Components: FDA Guide, and SBOM for Third-Party Chip Firmware.

Use the mistakes article before communicating a conclusion. Its title concerns underlying evidence gaps, not a requirement to submit VEX: missing VEX is not itself an FDA deficiency. An upstream patch does not make an older shipped version fixed, and a low CVSS score does not justify excluding a known vulnerability from assessment.

How Can You Record a VEX Assessment?

Record product scope, evidence, status rationale, and the review decision before communicating a conclusion. Keep unresolved assessments under_investigation; do not let a template choose a favorable status by default.

The VEX assessment worksheet provides a structured place to record the analysis. It produces a printable worksheet, not a schema-valid machine-readable VEX document, and it does not approve a manufacturer's risk decision.

If recipients need machine-readable VEX, choose a supported format, satisfy its required fields, validate the document, and obtain manufacturer review. Reassess when product versions, vulnerability information, or controls change; there is no universal monthly VEX deadline.

How Blue Goat Cyber Approaches This

We connect the status statement to the device evidence behind it. The work begins with the product version, software inventory, vulnerability details, and architecture rather than a preferred label.

Our engineers hold credentials including CISSP and OSCP. We review whether assessment scope is clear, supporting analysis explains the conclusion, and the status matches versions actually shipped. Security testing can provide evidence where exploitability or a control needs investigation, but a scan alone is not a final VEX assessment.

Our postmarket SBOM and VEX monitoring support connects findings with triage records, remediation tracking, and updated documentation within the agreed scope. The manufacturer retains ownership of risk acceptance and approval. Optional VEX communication remains separate from clinical decisions and submission outcomes.

Frequently Asked Questions

What are the VEX resources for medical device teams?

The core resources are the VEX document guide, the SBOM-versus-VEX comparison, and the common mistakes article linked above. They cover statement preparation, the distinction between inventory and assessment, and errors that undermine evidence. Start with the guide for technical definitions; use the other posts to check assumptions before communicating an assessment about a specific product version.

Does the FDA require VEX for medical devices?

No. The February 3, 2026 premarket cybersecurity guidance does not mention VEX, and Section 524B does not require a VEX document. Covered cyber-device submissions do require an SBOM under Section 524B. Vulnerability identification, risk assessment, and controls still matter whether or not the manufacturer chooses VEX to communicate part of that analysis.

Can a CVSS score decide the VEX status?

No. CVSS describes technical severity; VEX communicates a product-specific assessment. A high score does not prove vulnerable code is present or exploitable in the device, and a low score does not justify ignoring a known vulnerability. Investigate product versions, code paths, controls, and device consequences before selecting a status or making a risk decision.

Is the printable worksheet a machine-readable VEX document?

No. The worksheet records product, vulnerability, status, evidence, and review information. It is not an export validated against CSAF, OpenVEX, CycloneDX, or another VEX schema. A team needing machine-readable communication must choose a format, satisfy its required fields, validate the resulting document, and obtain manufacturer review before issuing the statement.

Continue With the VEX Guide

Use the VEX document guide for medical devices for your next assessment. Check status definitions against the evidence you hold, then use the comparison and mistakes articles to review scope, identifiers, and assumptions. Keep unresolved conclusions open for investigation rather than letting a document template decide the outcome.