CSAF / ts-mCTP

CSAF — Vulnerability Communication

Automated creation and distribution of Security Advisories in CSAF standard. Structures vulnerability communication between manufacturers, CERTs and users — machine-readable and CRA-compliant.

Start free trial →

At a Glance

CRA & NIS2

Meets the requirements of the Cyber Resilience Act and the NIS2 Directive for vulnerability communication towards ENISA and users.

CSAF 2.0

Full support of the OASIS CSAF 2.0 standard. Machine-readable advisories for automated processing.

CVE Import

Automatic import of CVE information and references into your Security Advisories. No manual research needed.

VEX Support

Create VEX documents manually or automated — false positives in the SBOM are exported directly as VEX statements.

Multiple Advisory Types

Not just Security Advisories: create and publish Security Incidents and Informational Advisories as well.

Automatic Distribution

Advisories are automatically distributed to configured recipients, CSAF providers and aggregators.

Advisory Editor

Guided creation of Security Advisories with validation against the CSAF schema. From draft to publication.

CSAF Provider

Operate your own CSAF Provider according to the OASIS standard. Auto-discovery for aggregators.

The Challenge

The Cyber Resilience Act requires manufacturers to actively communicate vulnerabilities — to ENISA, to users, to CERTs. Without a standardised format and automated process, this quickly becomes overwhelming.

How CSAF Works

TrustSource guides you through the creation of Security Advisories in CSAF 2.0 format. The integrated editor validates against the schema, and the workflow ensures that advisories are reviewed and approved before publication.

Publication

For publishing your advisories, we offer two options:

Dedicated Trusted Provider: Your CSAF Provider under your own brand, e.g. escra.csaf.trustsource.io. Your own domain, your own branding.
Shared Provider: Use a stream on our provider at trustsource.csaf.trustsource.io. Ready to use immediately, no infrastructure needed.

CSAF Community Days 2025

Jan Thielscher presents at the CSAF Community Days 2025 how TrustSource implements the automated creation and distribution of Security Advisories in the CSAF standard.