Oct 21, 2025·CISA · Pledge expansionActiveMedium impact
CISA Secure by Design pledge now expects VEX publication
CISA expanded the Secure by Design pledge so signatories are expected to publish VEX statements alongside SBOMs for shipped products.
What changed
- VEX publication is now an explicit pledge expectation, not an aspirational item.
- Pledge tracker pages flag signatories that publish SBOM but not VEX.
Action for manufacturers
If you've signed the pledge, stand up a public VEX channel; if you haven't, expect customers to ask why.