# KEV (Known Exploited Vulnerabilities) - Potential Format (BCP-07)

**URL:** <https://discourse.ossbase.org/t/kev-known-exploited-vulnerabilities-potential-format-bcp-07/744>\
**Category:** GCVE\
**Tags:** gcve\
**Created:** [December 24, 2025, 9:33am UTC](https://discourse.ossbase.org/t/kev-known-exploited-vulnerabilities-potential-format-bcp-07/744 "2025-12-24T09:33:03Z")\
**Posts on this page:** 5\
**Page:** 3

<div class="post-metadata">

**Author:** ![adulau](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/adulau/32/6_2.png) [@adulau](https://discourse.ossbase.org/u/adulau)\
**Post date:** [February 15, 2026, 2:41pm UTC](https://discourse.ossbase.org/t/kev-known-exploited-vulnerabilities-potential-format-bcp-07/744/42 "2026-02-15T14:41:06Z")

</div>

Indeed. At least for the contractual requirement, the [KEV format (BCP-07)](https://gcve.eu/bcp/gcve-bcp-07/) can be used to inform customers (even if the KEV is not disclosed outside the customer-vendor relationship). I suppose some extension in the KEV assertion can be indeed added.

By the way, I did a quick mapping of CRA obligations and how GCVE can support it at the following location:

> [@CRA and GCVE overview](https://discourse.ossbase.org/t/cra-and-gcve-overview/1017):
>
> Vendor as a GCVE GNA and decentralized vulnerability publication workflow What it means for a vendor to become a GNA in the GCVE model Across GCVE BCPs, a GNA is treated as a publisher of vulnerability information and related metadata with decentralized operational control: The directory is a trust anchor: “The directory file contains authoritative metadata about GCVE Numbering Authorities (GNAs)” (BCP-01 “Abstract” / “Scope and Purpose”). Publication is decentralized by design: “each GNA has …

If you have any feedback or updates, feel free. Thank you!

---

<div class="post-metadata">

**Author:** ![rjb4standards](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/rjb4standards/32/243_2.png) [@rjb4standards](https://discourse.ossbase.org/u/rjb4standards)\
**Post date:** [February 15, 2026, 3:54pm UTC](https://discourse.ossbase.org/t/kev-known-exploited-vulnerabilities-potential-format-bcp-07/744/43 "2026-02-15T15:54:46Z")

</div>

The CISA ICT\_SCRM Task Force struggled with role names, like Vendor, Producer, Manufacturer, Supplier, et al when the CISA Software Acquisition Guide was produced. It was decided to go with “Supplier” in order to support both commercial and open source scenarios - you can see how this matter was addressed in the CISA SAG (page 2 blue box key terms); [https://www.cisa.gov/sites/default/files/2024-07/PDM24050%20Software%20Acquisition%20Guide%20for%20Government%20Enterprise%20ConsumersV2\_508c.pdf](https://www.cisa.gov/sites/default/files/2024-07/PDM24050%20Software%20Acquisition%20Guide%20for%20Government%20Enterprise%20ConsumersV2_508c.pdf)

---

<div class="post-metadata">

**Author:** ![adulau](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/adulau/32/6_2.png) [@adulau](https://discourse.ossbase.org/u/adulau)\
**Post date:** [February 15, 2026, 4:07pm UTC](https://discourse.ossbase.org/t/kev-known-exploited-vulnerabilities-potential-format-bcp-07/744/44 "2026-02-15T16:07:44Z")

</div>

It’s a pretty good document for the procurement aspect which is often neglected. I’m curious if we could generate a machine parseable output of all the controls points. Do you know the license of the document? and if we can freely reuse/redistribute the content? It’s clearly outside the KEV BCP-07 but it could be useful as reference point for the BCP-02 at least in the GCVE ecosystem.

---

<div class="post-metadata">

**Author:** ![rjb4standards](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/rjb4standards/32/243_2.png) [@rjb4standards](https://discourse.ossbase.org/u/rjb4standards)\
**Post date:** [February 15, 2026, 4:22pm UTC](https://discourse.ossbase.org/t/kev-known-exploited-vulnerabilities-potential-format-bcp-07/744/45 "2026-02-15T16:22:57Z")

</div>

A machine readable version of the CISA SAG controls is already available, along with an open source reader to process “batches” of SAG-spreadsheet responses in Excel format;

CISA SAG Spreadsheet: [https://www.cisa.gov/sites/default/files/2024-08/PDM24064%20Software%20Acquisition%20Guide%20for%20Government%20Enterprise%20Consumers%20Final-%2020240710\_v19.xlsx](https://www.cisa.gov/sites/default/files/2024-08/PDM24064%20Software%20Acquisition%20Guide%20for%20Government%20Enterprise%20Consumers%20Final-%2020240710_v19.xlsx)

CISASAGReader tool: [GitHub - rjb4standards/CISASAGReader: Python app to read CISA Software Acquisition Guide Spreadsheets based on CISA format https://cisa.gov/sag](https://github.com/rjb4standards/CISASAGReader)

A short overview presentation of the CISA SAG is also available here: [https://github.com/rjb4standards/Presentations/raw/refs/heads/master/FINAL-CANDIDATE%20JAN292026%20CISA%20Secure%20by%20Design%20Software%20Acquisition%20Guide%20](https://github.com/rjb4standards/Presentations/raw/refs/heads/master/FINAL-CANDIDATE%20JAN292026%20CISA%20Secure%20by%20Design%20Software%20Acquisition%20Guide%20)(.pptx

You may also want to take a look at the open source Product Vulnerability Disclosure Report (VDR) format [REA-Products/JSON-SCHEMAS/SAG-VDR-SCHEMA.json at master · rjb4standards/REA-Products · GitHub](https://github.com/rjb4standards/REA-Products/blob/master/JSON-SCHEMAS/SAG-VDR-SCHEMA.json) ; both the BCP-07 and open source VDR formats may be considered as part of the work underway in the US Energy industry to address the “CVE blind spot", [https://www.naesb.org/pdf4/n\_weq\_bps\_css022426a.doc](https://www.naesb.org/pdf4/n_weq_bps_css022426a.doc)

All are free to use

---

<div class="post-metadata">

**Author:** ![adulau](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/adulau/32/6_2.png) [@adulau](https://discourse.ossbase.org/u/adulau)\
**Post date:** [July 3, 2026, 8:29am UTC](https://discourse.ossbase.org/t/kev-known-exploited-vulnerabilities-potential-format-bcp-07/744/46 "2026-07-03T08:29:47Z")

</div>

# GCVE-BCP-07 - Known Exploited Vulnerability - KEV Assertion Format updated to version 2.1

Following the PTS 2026 workshop in Lille, a new version of GCVE-BCP-07 has been published.

This version introduces the index reference file format, available at `https://gcve.eu/dist/references.json`, and adds new metadata fields, including `licenses`, as requested by ENISA.

> **[GCVE-BCP-07 - Known Exploited Vulnerability - KEV Assertion Format](https://gcve.eu/bcp/gcve-bcp-07/)**
>
> Known Exploited Vulnerability - KEV Assertion Format
> 
> Version: 2.1
> Status: Published (for Public Review)
> Date: 2026-07-03
> Authors: GCVE Working Group
> BCP ID: BCP-07
> 
> This guide is distributed and available under CC-BY-4.0.
> Copyright (C) 2025-2026...

## BCP-07

BCP-07 describes individual KEV assertions, but implementers also need a way to discover which organisations publish KEV catalogues and where their machine-readable feeds are located. The GCVE initiative publishes a non-mandatory KEV source index at [https://gcve.eu/dist/references.json](https://gcve.eu/dist/references.json) and maintains the source file at [gcve.eu/static/dist/references.json at main · gcve-eu/gcve.eu · GitHub](https://github.com/gcve-eu/gcve.eu/blob/main/static/dist/references.json).

The index is a catalogue of KEV catalogues. It is not authoritative for the content of any listed catalogue and it is not required for a producer to publish BCP-07 KEV assertions. Its purpose is to facilitate discovery, correlation, and stable attribution of KEV catalogues, especially where `gcve.origin_uuid` or `evidence[].gcve.origin_uuid` values need to be resolved to a known source.

[Previous page](https://discourse.ossbase.org/t/kev-known-exploited-vulnerabilities-potential-format-bcp-07/744.md?page=2)