Unified evidence model addressing #278, #333 and other concerns.

[stevespringett]

Closes #979
Closes #278
Closes #333

[jkowalleck]

RFC notice sent on July 20, 2026

• https://groups.io/g/CycloneDX/topic/120352781
• https://cyclonedx.slack.com/archives/CVA0G10FN/p1784506598160339

Public RFC period ends August 17, 2026

[planetlevel]

@stevespringett - in reviewing all this, it occurs to me that we do a good job of capturing evidence of vulnerability. But to really understand a risk, it's important to understand any compensating controls. It's like evidence against vulnerability - that it doesn't exist or isn't as dangerous as it might be. Like VEX sort of. I'm wondering if we should add something in the standard to model these controls so that you can take them into account. Is this already handled somehow? Or is this somewhere else in the standard that I missed?

If we dd this, we could distinguish inherent and residual ratings and allow the residual rating to reference the mitigation assertion.