CISA Secure by Design pledge expanded with VEX publication expectation

What changed

• VEX publication is now an explicit pledge expectation, not an aspirational item.
• Pledge tracker pages flag signatories that publish SBOM but not VEX.

Action for manufacturers

If you've signed the pledge, stand up a public VEX channel; if you haven't, expect customers to ask why.

Primary sources

• CISA Secure by Design

Related Blue Goat Cyber resources

• VEX document for medical device FDA