HomeResourcesISACA JournalIssues2026Volume 4Moving Beyond Severity Scores A VEX Driven Approach to Safety Critical System Risk
Volume 4

Moving Beyond Severity Scores: A VEX-Driven Approach to Safety-Critical System Risk

Moving Beyond Severity Scores: A VEX-Driven Approach to Safety-Critical System Risk
Author: Devashri Datta
Date Published: 26 August 2026
Read Time: 7 minutes

Software supply chain security is becoming more demanding in practice. Organizations are increasingly expected to produce software bills of materials (SBOMs) and Vulnerability Exploitability eXchange (VEX) documents, yet many still struggle to translate these artifacts into clear, defensible risk decisions...

 

Members, login to keep reading.

Not a member but want to read more?
Explore ISACA member benefits today.

Additional resources

mayeul-obel-okeli
Blog Post
Architecting Third-Party Resilience to Safeguard Business Value

The sheer volume of third-party relationships and the rapidly evolving cyber risk landscape demand that business leaders implement adaptive, pragmatic TPRM programs — rooted in board-approved risk appetite and aligned with strategic goals.

28 July 2026
The logo of the game appears against a solid black backdrop.
ISACA Journal Article
Building Robust Cyberresilience: A Practical Guide to Modern TPRM

A robust TPRM program requires that organizations move away from checklist-style vendor risk management and toward third-party cyberresilience.

Authors: Ulises Retamal and Megan Sepper
Policy Template Library Toolkit
Tool
Policy Template Library Toolkit | Digital | English

Policies are designed to formally document and communicate required and prohibited activities and behaviors to guide enterprise operational processes.