<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Franklin Gothic Book";
panose-1:2 11 5 3 2 1 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
p.xxparagraph, li.xxparagraph, div.xxparagraph
{mso-style-name:x_x_paragraph;
margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.xxmsonormal, li.xxmsonormal, div.xxmsonormal
{mso-style-name:x_x_msonormal;
margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.xxcontentpasted0
{mso-style-name:x_x_contentpasted0;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<div>
<div>
<div>
<p class="xxparagraph"><span style="font-size:12.0pt;font-family:"Franklin Gothic Book",sans-serif">FYSA<o:p></o:p></span></p>
<p class="xxparagraph"><span style="font-size:12.0pt;font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><span style="font-size:12.0pt;font-family:"Times New Roman",serif;color:black"><o:p></o:p></span></p>
<p class="xxmsonormal" style="font-kerning:none"><span class="xxcontentpasted0"><span style="font-size:12.0pt;font-family:"Franklin Gothic Book",sans-serif;color:black">Today, the Cybersecurity and Infrastructure Security Agency (CISA) released the
<a href="https://www.cisa.gov/resources-tools/resources/minimum-requirements-vulnerability-exploitability-exchange-vex">
Minimum Requirements for Vulnerability Exploitability eXchange</a> (VEX) and <a href="https://www.cisa.gov/resources-tools/resources/types-software-bill-materials-sbom">
Types of Software Bill of Materials</a> (SBOM) documents. Led by CISA, both publications were debated and drafted by a community of industry and government experts with the goal to offer some common guidance and structure for the large and growing global SBOM
community. </span></span><span style="color:black"><o:p></o:p></span></p>
<p class="xxmsonormal"><span style="font-size:12.0pt;font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="xxmsonormal"><span class="xxcontentpasted0"><span style="font-size:12.0pt;font-family:"Franklin Gothic Book",sans-serif;color:black">The Types of SBOM document summarizes common types of SBOMs that tools may create in the industry today, along with
the data typically presented for each type of SBOM. As software goes from planning to source to build to deployed and used, tools may be able to detect subtle differences in the underlying components. These types will allow for better differentiation of tools
and in the broader marketplace. </span></span><span style="color:black"><o:p></o:p></span></p>
<p class="xxmsonormal"><span style="font-size:12.0pt;font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="xxmsonormal"><span class="xxcontentpasted0"><span style="font-size:12.0pt;font-family:"Franklin Gothic Book",sans-serif;color:black">The Minimum Requirements for VEX document specifies the minimum elements to create a VEX document. This will allow
interoperability between different implementations and data formats of VEX. It will also help promote integration of VEX into novel and existing security tools. This document also specifies some optional VEX elements. </span></span><span style="color:black"><o:p></o:p></span></p>
<p class="xxmsonormal"><span style="font-size:12.0pt;font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="xxmsonormal"><span class="xxcontentpasted0"><span style="font-size:12.0pt;font-family:"Franklin Gothic Book",sans-serif;color:black">This process to debate and draft these documents underscore the value CISA places on bringing together the private
and public sector to develop timely resources that can help improve the cybersecurity marketplace. </span></span><span style="color:black"><o:p></o:p></span></p>
<p class="xxmsonormal"><span style="font-size:12.0pt;font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="xxmsonormal"><span class="xxcontentpasted0"><span style="font-size:12.0pt;font-family:"Franklin Gothic Book",sans-serif;color:black">Visit the
<a href="https://www.cisa.gov/sbom" title="https://www.cisa.gov/sbom">SBOM webpage</a> for information on CISA’s work on this issue. </span></span><span class="xxcontentpasted0"><span style="font-size:12.0pt;font-family:"Franklin Gothic Book",sans-serif"><o:p></o:p></span></span></p>
<p class="xxmsonormal"><o:p> </o:p></p>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b><span style="color:#1F497D">Theresa A. Masse<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Cybersecurity State Coordinator/Advisor, Region 10 (Oregon)
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Cybersecurity and Infrastructure Security Agency<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Department of Homeland Security<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Phone: (503) 930-5671
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Email:</span><span style="font-size:10.0pt;color:#777777">
</span><a href="mailto:theresa.masse@cisa.dhs.gov"><span style="font-size:10.0pt;color:#0563C1">theresa.masse@cisa.dhs.gov</span></a><u><span style="font-size:10.0pt;color:#0760C1"><o:p></o:p></span></u></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><img border="0" width="97" height="97" style="width:1.0138in;height:1.0138in" id="Picture_x0020_1" src="cid:image001.png@01D9742C.BCCAF160"><span style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="xxmsonormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
</body>
</html>