Disclosure Timeline
A disclosure timeline is the agreed or stated period between a security researcher privately reporting a vulnerability to a manufacturer and the point at which either the fix is released or the vulnerability is publicly disclosed. The standard industry timeline is 90 days, though the CRA does not prescribe a specific period.
A disclosure timeline is the agreed or stated period between a security researcher privately reporting a vulnerability to a manufacturer and the point at which either the fix is released or the vulnerability is publicly disclosed. The standard industry timeline is 90 days, though the CRA does not prescribe a specific period.
CVD & Vulnerability ManagementWhat Is a Disclosure Timeline?
A disclosure timeline defines the coordinated period between a vulnerability being privately reported and it being made public. It balances two legitimate interests: the manufacturer's need for time to develop and deploy a fix, and the public's right to know about security risks so they can make informed decisions. The most widely adopted industry standard is 90 days from the vendor's receipt of a valid, reproducible report. This convention was popularised by Google Project Zero and has been endorsed by ENISA and most major vulnerability research programmes. The timeline starts when the manufacturer acknowledges receipt of a reproducible report — not when the researcher first contacts them. If no acknowledgement is received within a defined period (typically five business days), the timeline may be deemed to have started from the initial contact.
Grace Periods and Timeline Extensions
Most CVD policies provide for timeline extensions in specific circumstances. A 'grace period' (typically 14 days) may be granted when a patch is ready but requires additional time for deployment by users — for example, when OTA update infrastructure needs preparation. Extensions for complex systemic vulnerabilities (those affecting widely deployed infrastructure or requiring industry-wide coordination) may be longer. Timeline extensions should be negotiated with the reporting researcher, not unilaterally imposed. The researcher retains the right to publish when the agreed timeline expires, even if no patch is available. Vendors that routinely seek extensions without demonstrated progress lose researcher trust and may find their reports being published without the full coordination period.
Disclosure Timelines for Multi-Vendor Vulnerabilities
When a single vulnerability affects components used across multiple products from different manufacturers — a common scenario with open source libraries or shared silicon — coordinating disclosure across all affected parties significantly complicates the timeline. In these cases, a CVD coordinator (such as ENISA, CERT/CC, or a national CSIRT) typically manages the coordinated multi-party disclosure (CMVD) process. The disclosure timeline is set to allow all affected vendors sufficient time to develop and release patches. Manufacturers should have a defined process for participating in multi-party coordinations, including authority to commit to a disclosure date, a fast-track patch development process, and pre-arranged communication with their customers and distribution channels.
Managing Disclosure Timeline Failures
When a manufacturer cannot meet the agreed disclosure timeline — either because a patch cannot be ready in time or because the fix requires architectural changes spanning multiple releases — the options are:
- Publish without a complete fix: Release a security advisory disclosing the vulnerability with available mitigations, accepting that full remediation will follow.
- Negotiate an extension: Agree with the researcher on a specific extended date with concrete progress milestones.
- Publish at deadline regardless: The researcher's right to publish after the deadline is generally respected in the industry.
Failing to communicate with the researcher as the deadline approaches — rather than seeking an explicit extension — consistently leads to surprise public disclosures that damage manufacturer credibility and expose users unnecessarily.
CVD Portal makes Disclosure Timeline compliance straightforward.
Public CVD submission portal, acknowledgment tracking, Article 14 deadline alerts, and CSAF advisory generation. Free forever for EU manufacturers.
Start your free portalFrequently asked
Is 90 days the legally required disclosure timeline under the CRA?+
No. The CRA does not specify a mandatory 90-day timeline. It requires manufacturers to establish a CVD policy and handle vulnerabilities within timeframes consistent with reasonable practice. The 90-day standard is an industry norm, endorsed by ENISA and widely followed. Manufacturers should state their expected timeline in their published CVD policy and apply it consistently. Shorter timelines for critical vulnerabilities and longer timelines for complex systemic issues are both acceptable when justified and communicated clearly.
What can a researcher do if a manufacturer ignores a report and the timeline expires?+
If a manufacturer does not respond to a vulnerability report and the disclosure timeline expires, the researcher is generally within their rights — under widely accepted coordinated disclosure norms — to publish the vulnerability details. Before doing so, the researcher may escalate to a CVD coordinator such as ENISA, CERT/CC, or a national CSIRT, who can attempt to engage the manufacturer. For CRA-covered products, a non-responsive manufacturer is also non-compliant with Article 13(6), and ENISA or a national MSA can be notified.
Does the disclosure timeline apply to zero-day vulnerabilities already being exploited?+
When a vulnerability is being actively exploited in the wild, the traditional disclosure timeline logic changes significantly. The CRA requires notification to ENISA within 24 hours of a manufacturer becoming aware of an actively exploited vulnerability. In active exploitation scenarios, the priority shifts to rapid remediation and user notification — researchers and vendors typically agree to accelerate public disclosure to enable defenders to take action, rather than waiting for the full timeline to expire.
Related terms
Browse the full CRA Compliance Checklist
See how Disclosure Timeline fits into your complete CRA compliance programme.