Blue Goat CyberBlue Goat CyberSMMedical Device Cybersecurity
    All regulatory tracker entries
    Oct 21, 2025·CISA · Pledge expansionActiveMedium impact

    CISA Secure by Design pledge now expects VEX publication

    CISA expanded the Secure by Design pledge so signatories are expected to publish VEX statements alongside SBOMs for shipped products.

    What changed

    • VEX publication is now an explicit pledge expectation, not an aspirational item.
    • Pledge tracker pages flag signatories that publish SBOM but not VEX.

    Action for manufacturers

    If you've signed the pledge, stand up a public VEX channel; if you haven't, expect customers to ask why.

    Primary sources

    Related Blue Goat Cyber resources

    Ready when you are

    Secure your device before it reaches patients.

    30-minute strategy session. No cost, no commitment - just answers from people who've supported 275+ FDA submissions, with zero cybersecurity rejections.

    Book strategy sessionExplore services