Coordinated Vulnerability Disclosure (CVD)

Coordinated Vulnerability Disclosure (CVD) is a structured process in which a security researcher who discovers a vulnerability in a product privately notifies the affected manufacturer before publishing any details publicly. The manufacturer is given a reasonable timeframe — typically 90 days — to develop, test, and release a fix. Only after a patch is available (or the deadline passes) does the researcher disclose the vulnerability publicly. CVD balances two competing interests: the public's right to know about security risks and the vendor's need for time to fix them. It differs from full disclosure, where details are published immediately, and bug bounty programmes, which add financial incentives.

Article 13(6) of the EU Cyber Resilience Act explicitly requires manufacturers to establish and maintain a coordinated vulnerability disclosure policy. Recital 63 reinforces that manufacturers must enable researchers and users to report vulnerabilities through accessible channels. The CRA treats CVD not as a best practice but as a mandatory legal obligation for all manufacturers of products with digital elements placed on the EU market. Failure to maintain a functioning CVD process constitutes non-compliance and can result in market surveillance authority (MSA) enforcement action, including product bans and fines. ENISA published a CVD Good Practice Guide that regulators treat as a reference standard.

A compliant CVD implementation requires four components:

1. A disclosure channel — a published email address or web form where researchers can submit reports, typically secured with a PGP key.
2. A CVD policy — a written document (often published at /.well-known/security.txt) stating scope, safe harbour terms, and expected response times.
3. An internal triage process — a defined workflow for validating, prioritising, and remediating reported vulnerabilities, usually owned by a PSIRT.
4. A public advisory process — a mechanism for publishing security advisories (ideally in CSAF format) once a fix is released.

CVD Portal automates all four steps for manufacturers subject to the CRA.

Manufacturers frequently make the following errors:

• No published contact — researchers cannot find where to send reports, so vulnerabilities go unreported or are disclosed on social media instead.
• No safe harbour clause — without explicit legal protection for good-faith researchers, potential reporters fear legal action and stay silent.
• Missing response SLAs — a policy without defined timelines (e.g. 5-day acknowledgement, 90-day resolution target) is unenforceable and untrustworthy.
• No CVSS scoring or severity triage — all reports treated equally creates backlog and missed critical issues.
• Conflating CVD with bug bounty — CVD is a compliance requirement; a bug bounty programme is optional and complementary.