Basic CVD Policy Template
A straightforward coordinated vulnerability disclosure policy aligned with ISO/IEC 29147. Covers the core commitments expected by security researchers and satisfies CRA Article 13 requirements.
Introduction and Purpose
Article 13(1)[COMPANY NAME] is committed to the security of our products and services. We believe that coordinated vulnerability disclosure benefits our customers and the broader digital community.
This policy describes how security researchers and the public can report potential security vulnerabilities in [COMPANY NAME] products, and the commitments we make in response.
Keep this brief. Researchers read many policies and want to reach the reporting instructions quickly. One clear statement of commitment is enough.
Scope
Article 13(4)This policy applies to vulnerabilities in:
- [PRODUCT NAME 1] (versions [X.X] and later)
- [PRODUCT NAME 2]
- [WEBSITE / API at DOMAIN.COM]
Out of scope:
- Products that have reached end-of-life (see [SUPPORT LIFECYCLE URL])
- Third-party services not operated by [COMPANY NAME]
- Denial-of-service attacks
- Social engineering
Be specific about which products are covered. Listing out-of-scope items prevents wasted reports and sets clear expectations for researchers.
How to Report a Vulnerability
Article 13(1)To report a security vulnerability, contact our security team:
Email: [[email protected]] PGP Key: Fingerprint [FINGERPRINT] — available at [KEY URL] Portal: [PORTAL URL]
We accept reports in English [and LANGUAGE if applicable].
Do not report security vulnerabilities through public issue trackers, social media, or support tickets.
Provide a dedicated security contact. A vulnerability portal (like CVD Portal) starts your 48-hour acknowledgment clock automatically and creates an audit trail for CRA compliance.
What to Include in Your Report
Please include:
- Affected product and version
- Vulnerability type (e.g. authentication bypass, command injection, insecure update)
- Impact: What could an attacker achieve?
- Reproduction steps: Step-by-step instructions
- Proof of concept: Code, screenshots, or video (optional but helpful)
- Your contact details: So we can update you and credit you (optional)
Well-structured guidance here improves report quality, speeds up triage, and reduces back-and-forth with reporters.
Our Commitments
Article 13(1)[COMPANY NAME] commits to:
- Acknowledgment within 48 hours of receiving your report
- Initial severity assessment within [5] business days
- Status updates at least every [30] days until resolved
- Notification when the vulnerability is patched
- Credit in our security advisory unless you prefer anonymity
48-hour acknowledgment is the ISO 29147 standard and the CRA Article 13 expectation. Committing to it publicly builds researcher trust and is evidence of a mature process.
Safe Harbour
Security research conducted in good faith and in accordance with this policy is authorised by [COMPANY NAME]. We will not pursue legal action against researchers who:
- Comply with this policy
- Avoid accessing or modifying data beyond what is necessary to demonstrate the vulnerability
- Do not intentionally disrupt our services
- Report vulnerabilities to us before public disclosure
[COMPANY NAME] views good-faith research as a contribution to product security.
A safe harbour statement is essential for attracting responsible researchers. Without it, researchers may hesitate to report for fear of legal consequences. Have your legal team review this section.
Coordinated Disclosure
Article 13(4)[COMPANY NAME] requests [90] days from initial report to address vulnerabilities before public disclosure. We will:
- Work with you on disclosure timing
- Coordinate with upstream vendors if required
- Notify you before publishing any security advisory
- Credit you in our advisory if you wish
If you believe a vulnerability requires faster disclosure due to active exploitation, please contact us before proceeding publicly.
90 days is the widely-accepted industry standard (aligned with Google Project Zero). Mentioning upstream vendor coordination is important under the CRA, which requires supply chain vulnerability handling.
Use this template automatically in CVD Portal
CVD Portal generates your CVD policy, tracks acknowledgments, and creates an audit trail — free, forever.
Set up your free portal