What is coordinated vulnerability disclosure?

Coordinated vulnerability disclosure (CVD) is the practice of a researcher reporting a vulnerability privately to the vendor, allowing time for a fix before public disclosure. It balances the public's right to know with the need to protect users from exploitation before a patch is available. The process is standardised in ISO/IEC 29147.

How is CVD different from responsible disclosure?

The terms are often used interchangeably. 'Responsible disclosure' is an older term. 'Coordinated vulnerability disclosure' is the current ISO standard terminology and is preferred by ENISA and most national CSIRTs. The key distinction is that CVD explicitly involves coordination between the researcher and vendor, whereas 'responsible disclosure' was sometimes used to mean any form of private reporting.

What if 90 days is not enough time to fix the vulnerability?

We will contact you to discuss an extension and explain the reason for the delay. We may release interim mitigations or workarounds to protect users while the full fix is developed. We will never exceed an extension without your agreement.

Do I need to be a registered researcher to report?

No. Anyone can report a vulnerability under this policy. You do not need to register, disclose your identity, or agree to any terms beyond those stated here.

What happens if a vulnerability is already being exploited?

We will prioritise remediation and may compress the disclosure timeline. We will always notify you before public disclosure. If the vulnerability triggers our Article 14 obligations under the CRA, we will also notify ENISA within 24 hours of becoming aware.

← All templates

Free Template

Coordinated Vulnerability Disclosure Policy Template

A complete coordinated vulnerability disclosure policy following ISO/IEC 29147 best practice and CRA Article 13. Covers the full disclosure lifecycle: intake, triage, remediation, and coordinated publication.

Article 13 · Article 14

ForAny organisation that develops, manufactures, or maintains software or connected products and wants a robust, standards-aligned CVD policy

CRA Articles

Article 13Article 14

Purpose and Scope

Article 13(1)

[COMPANY NAME] believes that responsible disclosure of security vulnerabilities makes our products safer for everyone. This Coordinated Vulnerability Disclosure (CVD) Policy describes how we work with security researchers and customers to identify, validate, and remediate security vulnerabilities in [COMPANY NAME] products and services.

This policy applies to all [COMPANY NAME] products, services, and digital infrastructure. It does not apply to vulnerabilities in third-party services or open-source components not directly maintained by [COMPANY NAME].

Note

A clear scope statement prevents ambiguity about what is in-programme. List your major product lines or service domains explicitly. An overly narrow scope reduces the value of your programme.

Reporting a Vulnerability

Article 13(1)

To report a potential security vulnerability, please contact our security team:

Portal (preferred): [VULNERABILITY DISCLOSURE PORTAL URL] Email: [[email protected]] PGP key: Available at [PGP KEY URL] (fingerprint: [FINGERPRINT])

Please provide as much detail as possible, including:

Product name, version, and platform
Description of the vulnerability and its potential impact
Step-by-step reproduction instructions
Proof of concept (screenshots, code, or video)
Whether the issue is already known or being exploited

Note

Researchers need a clear, friction-free path to report. A dedicated portal creates an automatic audit trail. Always offer PGP encryption - it signals that you take confidential handling seriously.

Our Response Commitments

Article 13

We commit to the following timeline:

| Milestone | Target | |---|---| | Acknowledgment of receipt | Within 48 hours | | Initial severity assessment | Within 5 business days | | Remediation plan communicated | Within 30 days | | Regular status updates | At least every 30 days | | Patch release or advisory | As soon as practicable |

We will keep you informed throughout the process and notify you when the issue is resolved.

Note

Concrete timelines build trust with researchers. The 48-hour acknowledgment mirrors the CRA minimum. If you cannot meet a deadline, communicate proactively - silence is the fastest way to lose researcher goodwill.

Coordinated Disclosure Timeline

Article 13, Article 14

[COMPANY NAME] requests a coordinated disclosure period of [90] calendar days from the date of initial report. During this period:

We will work to validate, reproduce, and remediate the vulnerability.
We will keep you updated on progress at least every 30 days.
We ask that you refrain from publishing vulnerability details until a patch or advisory is available.

If a vulnerability is actively being exploited in the wild, we may accelerate the timeline and issue an advisory with or without a complete fix. We will always notify you before public disclosure.

If we cannot remediate within the coordinated period, we will discuss an extension with you and explain the reasons for the delay.

Note

90 days is the widely accepted industry standard (aligned with Google Project Zero). Be explicit that active exploitation can compress the timeline - this aligns with your CRA Article 14 obligations.

Safe Harbour

[COMPANY NAME] will not pursue legal or regulatory action against researchers who:

Discover and report vulnerabilities in good faith under this policy
Avoid intentional harm to users, services, or data beyond what is strictly necessary to demonstrate the issue
Do not access, modify, or exfiltrate data beyond what is needed for proof of concept
Notify us before disclosing to any third party
Comply with applicable law in their jurisdiction

We consider good-faith research conducted under this policy to be authorised and will communicate this to law enforcement if necessary.

Note

A safe harbour clause is essential. Researchers are much more likely to report to vendors who explicitly protect them. This also reduces legal overhead for your own team when handling reports.

Acknowledgment and Recognition

[COMPANY NAME] recognises the contributions of security researchers who help us improve the security of our products. With your permission, we will:

Acknowledge your contribution in the security advisory for the vulnerability
List your name or handle in our security acknowledgments page at [ACKNOWLEDGMENTS URL]

We do not currently offer a bug bounty programme. If that changes, we will update this policy.

All researchers will receive confirmation that their report contributed to a fix, regardless of whether they wish to be publicly credited.

Note

Recognition costs nothing and substantially increases researcher motivation to report. If you plan to add a bounty programme, note it here. Never promise what you cannot deliver.

Advisory Publication

Annex I

When a vulnerability is resolved, [COMPANY NAME] will publish a security advisory that includes:

CVE identifier (where assigned)
CVSS 3.1 or 4.0 severity score
Affected products and versions
Fixed versions
Remediation guidance for users
Acknowledgment of the reporting researcher (with permission)

Advisories are published at [ADVISORY URL] and distributed via [RSS FEED / EMAIL LIST / SECURITY MAILING LIST].

For qualifying vulnerabilities, advisories are also published in CSAF 2.0 format for machine-readable consumption.

Note

Publishing advisories with CVE IDs and CVSS scores demonstrates transparency. CSAF 2.0 is increasingly expected under the CRA and by enterprise procurement. CVD Portal generates CSAF advisories automatically.

Use this template automatically in CVD Portal

CVD Portal generates your CVD policy, tracks acknowledgments, and creates an audit trail — free for Article 14 compliance.

Set up your free portal

Frequently asked questions

Ready to go beyond the template?

CVD Portal automates acknowledgments, tracks deadlines, and generates CSAF advisories — free.

Set up your free portal

Related templates

CRA-Compliant CVD Policy Template

A comprehensive CVD policy structured specifically for the EU Cyber Resilience Act. Addresses Articles 13 and 14 obligations including 24-hour early warning, 72-hour full notification, and coordinated disclosure timelines.

Basic CVD Policy Template

A straightforward coordinated vulnerability disclosure policy aligned with ISO/IEC 29147. Covers the core commitments expected by security researchers and satisfies CRA Article 13 requirements.

Vulnerability Reporting Process Template

An internal-facing vulnerability reporting process that documents how your security team handles incoming reports from intake through resolution. Complements your public CVD policy with operational procedures aligned to CRA Article 13 and 14.

EU CVD Policy Template

A CVD policy template specifically written for EU manufacturers placing products on the European market. References EU-specific obligations (CRA, NIS2 intersection, ENISA), using terminology aligned with EU regulatory guidance.