CVD Policy

A CVD (Coordinated Vulnerability Disclosure) policy is a written document that tells security researchers and the general public how to report security vulnerabilities in a manufacturer's products. At minimum it must state: where to send reports (contact channel and encryption key), what information to include in a report, how quickly the manufacturer will acknowledge receipt, how long the manufacturer expects to take to remediate the issue, and what researchers are permitted to do during testing (scope and safe harbour terms). The policy is typically published at /.well-known/security.txt and on the manufacturer's product security webpage.

Article 13(6) of the CRA requires manufacturers to adopt and publish a coordinated vulnerability disclosure policy. The policy must be accessible and must enable researchers to report vulnerabilities securely. Article 14 adds that manufacturers must notify ENISA and relevant CSIRTs of actively exploited vulnerabilities within 24 hours of becoming aware — the CVD policy is the intake mechanism that starts this notification clock. A policy that lacks a clear contact method, defined response timelines, or explicit safe harbour language will not satisfy the CRA's requirements and may be flagged during conformity assessment.

A CRA-compliant CVD policy must include:

1. Contact details — a dedicated security email address, optionally with a PGP public key for encrypted submissions.
2. Scope — which products and versions are covered.
3. Safe harbour — an explicit statement that good-faith researchers will not face legal action under EU law or the manufacturer's terms of service.
4. Response SLAs — acknowledgement within 5 business days; status updates at regular intervals; remediation target (e.g. 90 days for critical issues).
5. Disclosure timeline — when and how the manufacturer will publish security advisories after a fix is released.
6. Out-of-scope activities — actions researchers must not take (e.g. destructive testing, accessing customer data).

The most frequent CVD policy failures observed in practice:

• Vague scope — policies that say "our products" without listing specific product lines leave researchers uncertain and create legal ambiguity.
• No safe harbour — without explicit legal protection, researchers default to public disclosure rather than risk legal action.
• Unrealistic SLAs — committing to 24-hour fixes signals the policy was not written by an engineering team and will not be honoured.
• Policy buried in legal terms — a policy embedded in a 50-page terms-of-service document fails the CRA's accessibility requirement.
• No PGP key — researchers reporting authentication or cryptographic vulnerabilities need an encrypted channel; a plain email address is insufficient.