Coordinated vulnerability disclosure policy

Description

A published, free, and easy-to-find way for security researchers and the public to report a vulnerability in a product, plus the internal process that receives, triages, and remediates those reports. The product-security regimes that have landed in 2024-2027 treat the disclosure channel as a standalone obligation rather than as a nice-to-have: the UK PSTI regime requires manufacturers of connectable consumer products to publish at least one contact point for security reports along with information on acknowledgement and status updates, and the EU Cyber Resilience Act requires manufacturers of products with digital elements to operate a coordinated vulnerability handling process across the support period. The practical shape of the control is a security.txt file or a /security page naming a monitored contact, an intake queue that does not require the reporter to hand over personal data, an internal SLA for acknowledgement and triage, and a record of how each report was resolved. The common failure is treating the contact address as the whole obligation; regulators reading the statute want to see that reports are actually acknowledged and acted on, not that an inbox exists.

Required by (2 regulations)

• EU CRA

  Manufacturers must operate a coordinated vulnerability handling and disclosure process for products with digital elements, including a contact address for reporting vulnerabilities, throughout the support period (Article 13 and Annex I Part II).

  Regulation (EU) 2024/2847 (Cyber Resilience Act), Article 13 and Annex I Part II; main obligations apply 2027-12-11

  Source →

• UK PSTI

  Manufacturers of relevant connectable products must publish information on how to report security issues, including at least one point of contact, and information about expected acknowledgement and status updates, provided free of charge.

  The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023 (SI 2023/1007), Schedule 1; in force 2024-04-29

  Source →

Evidence formats

• published vulnerability disclosure policy page or security.txt file naming a monitored contact
• internal triage runbook with acknowledgement and remediation SLAs
• log of received reports with resolution status
• coordinated-disclosure timeline records for remediated vulnerabilities