OASIS Common Security Advisory Framework (CSAF) TC

Hi Everyone, Hopefully by now you all reviewed the email from Mary Beth Minto outlining the PR blitz around the TCs upcoming announcement. Mary Beth is currently working on the press release. As she noted, OASIS Sponsor-level members will be able to submit a quote for the release. Deadline to submit a quote is 4 November. In addition to the press release, we discuss the possibility of a blog post and/or webinar. In order to move forward with either of these activities, we need the TCs support with both the content and marketing. These are optional activities, so we'll need official commitment from the TC before moving forward. Below are some preliminary details for the TC to consider. Please let us know by 7 October whether the TC would like to take advantage of either or both optional activities. Blog Post -- To be posted on the main OASIS Open website, linked to related websites and promoted via social media channels. A volunteer is needed from the TC to write the blog. OASIS will support the publishing and promoting of the blog. Blog would be published one or two days after the press release drops (16-17 November). Webinar -- Logistics would be handled by the OASIS team. Volunteers from the TC are needed to help develop the webinar content and present the content. Help from all TC members is needed to promote the webinar. Webinar would be scheduled two weeks after the press release announcement (tentatively scheduled for Wednesday, 30 November). Planning for the webinar would need to begin the week of 10 October. Again, please let us know by 7 October whether the TC would like to take advantage of a blog or webinar. Feel free to reach out directly to me if interested in volunteering for one or more activities. Kind regards, Jane BTW: Don't forget to send us your marketing contacts by tomorrow -- 30 September. We'd like to engage them ASAP. -- Jane Harnad Manager of Events OASIS Open +1 703-508-3373 jane.harnad@oasis-open.org www.oasis-open.org/events

Dear colleagues, I suggest that we take both opportunities and write a blog post and do the webinar. It is crucial that we increase our marketing for CSAF to push it. Becoming an OASIS standard is a great opportunity to do that. However, as my time is limited I can only help with one of them. Therefore, I throw my hat in the ring for the webinar and am looking for somebody who would like to join me. Is there anyone of the TC members, who could imagine to write the blog post? Best wishes, Thomas -- Thomas Schmidt From: csaf@lists.oasis-open.org <csaf@lists.oasis-open.org> On Behalf Of Jane Harnad Sent: Thursday, September 29, 2022 5:02 PM To: csaf@lists.oasis-open.org Cc: Mary Beth Minto <marybeth.minto@oasis-open.org> Subject: [csaf] CSAF Announcement - Blog and webinar opportunity Hi Everyone, Hopefully by now you all reviewed the email from Mary Beth Minto outlining the PR blitz around the TCs upcoming announcement. Mary Beth is currently working on the press release. As she noted, OASIS Sponsor-level members will be able to submit a quote for the release. Deadline to submit a quote is 4 November. In addition to the press release, we discuss the possibility of a blog post and/or webinar. In order to move forward with either of these activities, we need the TCs support with both the content and marketing. These are optional activities, so we'll need official commitment from the TC before moving forward. Below are some preliminary details for the TC to consider. Please let us know by 7 October whether the TC would like to take advantage of either or both optional activities. Blog Post -- To be posted on the main OASIS Open website, linked to related websites and promoted via social media channels. A volunteer is needed from the TC to write the blog. OASIS will support the publishing and promoting of the blog. Blog would be published one or two days after the press release drops (16-17 November). Webinar -- Logistics would be handled by the OASIS team. Volunteers from the TC are needed to help develop the webinar content and present the content. Help from all TC members is needed to promote the webinar. Webinar would be scheduled two weeks after the press release announcement (tentatively scheduled for Wednesday, 30 November). Planning for the webinar would need to begin the week of 10 October. Again, please let us know by 7 October whether the TC would like to take advantage of a blog or webinar. Feel free to reach out directly to me if interested in volunteering for one or more activities. Kind regards, Jane BTW: Don't forget to send us your marketing contacts by tomorrow -- 30 September. We'd like to engage them ASAP. -- Jane Harnad Manager of Events OASIS Open tel:+1+703-508-3373 mailto:jane.harnad@oasis-open.org https://www.oasis-open.org/events

I echo the comments from Thomas.   I was already planning to help on the webinar but can definitely help with the blog post. Diane from my team is also willing to help. She is an amazing writer.   Perhaps the webinar can be a panel including a vendor, BSI, and someone to represent a consumer/customer.   FYI: We are also planning to do short videos (~2/3 minutes long) explaining the following:   What is CSAF? (that one is done and already posted) What are the differences between CVRF and CSAF? What are the different CSAF profiles? What is VEX and how CSAF VEX profiles are used? What open-source tools exist for CSAF (Thomas, can you or someone in your team perhaps take the lead on this one)? How companies can use the provider-metadata.json to describe (to machines) where their CSAF content is, etc. How vulnerability coordinators use CSAF (Vijay, if interested, I can work with you on these.   I just created GitHub issues in our documentation/website repository to track these for now. Please let me know if anyone is interested in participating and contributing to any of these.   Thanks again! Omar     From: csaf@lists.oasis-open.org <csaf@lists.oasis-open.org> on behalf of Schmidt, Thomas <thomas.schmidt@bsi.bund.de> Date: Friday, September 30, 2022 at 12:33 PM To: csaf@lists.oasis-open.org <csaf@lists.oasis-open.org> Cc: Mary Beth Minto <marybeth.minto@oasis-open.org>, Jane Harnad <jharnad@oasis-open.org> Subject: RE: [csaf] CSAF Announcement - Blog and webinar opportunity Dear colleagues, I suggest that we take both opportunities and write a blog post and do the webinar. It is crucial that we increase our marketing for CSAF to push it. Becoming an OASIS standard is a great opportunity to do that. However, as my time is limited I can only help with one of them. Therefore, I throw my hat in the ring for the webinar and am looking for somebody who would like to join me. Is there anyone of the TC members, who could imagine to write the blog post? Best wishes, Thomas -- Thomas Schmidt From: csaf@lists.oasis-open.org <csaf@lists.oasis-open.org> On Behalf Of Jane Harnad Sent: Thursday, September 29, 2022 5:02 PM To: csaf@lists.oasis-open.org Cc: Mary Beth Minto <marybeth.minto@oasis-open.org> Subject: [csaf] CSAF Announcement - Blog and webinar opportunity Hi Everyone, Hopefully by now you all reviewed the email from Mary Beth Minto outlining the PR blitz around the TCs upcoming announcement. Mary Beth is currently working on the press release. As she noted, OASIS Sponsor-level members will be able to submit a quote for the release. Deadline to submit a quote is 4 November. In addition to the press release, we discuss the possibility of a blog post and/or webinar. In order to move forward with either of these activities, we need the TCs support with both the content and marketing. These are optional activities, so we'll need official commitment from the TC before moving forward. Below are some preliminary details for the TC to consider. Please let us know by 7 October whether the TC would like to take advantage of either or both optional activities.   • Blog Post -- To be posted on the main OASIS Open website, linked to related websites and promoted via social media channels. A volunteer is needed from the TC to write the blog. OASIS will support the publishing and promoting of the blog. Blog would be published one or two days after the press release drops (16-17 November). • Webinar -- Logistics would be handled by the OASIS team. Volunteers from the TC are needed to help develop the webinar content and present the content. Help from all TC members is needed to promote the webinar. Webinar would be scheduled two weeks after the press release announcement (tentatively scheduled for Wednesday, 30 November). Planning for the webinar would need to begin the week of 10 October. Again, please let us know by 7 October whether the TC would like to take advantage of a blog or webinar. Feel free to reach out directly to me if interested in volunteering for one or more activities.  Kind regards, Jane BTW: Don't forget to send us your marketing contacts by tomorrow -- 30 September. We'd like to engage them ASAP.   -- Jane Harnad Manager of Events OASIS Open       tel:+1+703-508-3373 mailto:jane.harnad@oasis-open.org https://www.oasis-open.org/events

Dear Jane, dear TC members, I would like to remind everyone that we decided to use the hash tag #oCSAF in social media instead of just CSAF as this was already used for someone else... @OASIS: It might be important to highlight that for the marketing contacts you received. Best wishes, Thomas -- Thomas Schmidt From: csaf@lists.oasis-open.org <csaf@lists.oasis-open.org> On Behalf Of Jane Harnad Sent: Thursday, September 29, 2022 5:02 PM To: csaf@lists.oasis-open.org Cc: Mary Beth Minto <marybeth.minto@oasis-open.org> Subject: [csaf] CSAF Announcement - Blog and webinar opportunity Hi Everyone, Hopefully by now you all reviewed the email from Mary Beth Minto outlining the PR blitz around the TCs upcoming announcement. Mary Beth is currently working on the press release. As she noted, OASIS Sponsor-level members will be able to submit a quote for the release. Deadline to submit a quote is 4 November. In addition to the press release, we discuss the possibility of a blog post and/or webinar. In order to move forward with either of these activities, we need the TCs support with both the content and marketing. These are optional activities, so we'll need official commitment from the TC before moving forward. Below are some preliminary details for the TC to consider. Please let us know by 7 October whether the TC would like to take advantage of either or both optional activities. Blog Post -- To be posted on the main OASIS Open website, linked to related websites and promoted via social media channels. A volunteer is needed from the TC to write the blog. OASIS will support the publishing and promoting of the blog. Blog would be published one or two days after the press release drops (16-17 November). Webinar -- Logistics would be handled by the OASIS team. Volunteers from the TC are needed to help develop the webinar content and present the content. Help from all TC members is needed to promote the webinar. Webinar would be scheduled two weeks after the press release announcement (tentatively scheduled for Wednesday, 30 November). Planning for the webinar would need to begin the week of 10 October. Again, please let us know by 7 October whether the TC would like to take advantage of a blog or webinar. Feel free to reach out directly to me if interested in volunteering for one or more activities. Kind regards, Jane BTW: Don't forget to send us your marketing contacts by tomorrow -- 30 September. We'd like to engage them ASAP. -- Jane Harnad Manager of Events OASIS Open tel:+1+703-508-3373 mailto:jane.harnad@oasis-open.org https://www.oasis-open.org/events