EU CVD Policy Template

[COMPANY NAME] operates a Coordinated Vulnerability Disclosure (CVD) programme in accordance with the EU Cyber Resilience Act (Regulation (EU) 2024/2847), ISO/IEC 29147, and ENISA guidelines on coordinated vulnerability disclosure.

This policy is publicly accessible and describes:

• How to report security vulnerabilities in [COMPANY NAME] products
• How [COMPANY NAME] handles and responds to vulnerability reports
• The rights and protections afforded to security reporters

Single Point of Contact: [[email protected]] | [PORTAL URL]

This policy applies to all [COMPANY NAME] products with digital elements placed on the EU market, including:

Hardware products:

• [HARDWARE PRODUCT 1] (model [X], EU Declaration of Conformity: [DOC NUMBER])
• [HARDWARE PRODUCT 2]

Software products:

• [SOFTWARE PRODUCT 1] (versions [X.X]+)

Associated services:

• Cloud interface at [DOMAIN]
• Mobile applications: [APP STORE LINKS]

Products that have reached end-of-support are listed at [SUPPORT LIFECYCLE URL]. Reports for end-of-life products are accepted but response timelines may differ.

To report a potential security vulnerability in a [COMPANY NAME] product:

Preferred method (fastest acknowledgment): Submit via our vulnerability disclosure portal: [PORTAL URL]

Alternative: Email [[email protected]] PGP fingerprint: [FINGERPRINT] (key available at [URL])

What to include:

• Product name and version
• Nature of the vulnerability (CWE category if known)
• Steps to reproduce
• Estimated severity and impact
• Proof-of-concept (optional)
• Whether you believe the vulnerability is already being exploited

Reports are accepted in: English [, German, French — edit as applicable]

[COMPANY NAME] commits to the following response milestones in accordance with ISO/IEC 29147 and CRA Article 13:

| Milestone | Timeline | |-----------|----------| | Acknowledgment of receipt | Within 48 hours | | Initial severity assessment | Within [5] business days | | Notification of in-scope determination | Within [10] business days | | Progress updates | Every [30] days until resolved | | Notification of patch release | Upon availability | | Security advisory publication | Within [30] days of patch |

Timelines may be extended for complex vulnerabilities affecting multiple products or upstream components. We will communicate any extensions proactively.

In accordance with Article 14 of the EU Cyber Resilience Act, [COMPANY NAME] is required to notify ENISA and the relevant national CSIRT when:

• A vulnerability in our product is actively exploited in the wild
• A severe security incident has occurred affecting our products

Notification timelines (from becoming aware):

• 24 hours: Early warning to ENISA
• 72 hours: Full notification with severity assessment
• 14 days: Final report with root cause and remediation

If your vulnerability report triggers an Article 14 notification, we will inform you (unless doing so would compromise an ongoing investigation or law enforcement action).

Authority notifications are made to: ENISA Single Reporting Platform and [NATIONAL CSIRT — see list at enisa.europa.eu/topics/csirts-in-europe]

[COMPANY NAME] recognises the value of good-faith security research. Researchers who comply with this policy have our commitment that:

• We will not pursue civil or criminal action against them for vulnerability research conducted in accordance with this policy
• We will not make reports to law enforcement agencies arising from their research under this policy
• We will work collaboratively with them throughout the disclosure process

In return, we ask researchers to:

• Access only data necessary to demonstrate the vulnerability
• Avoid intentional disruption of our services or exposure of user data
• Allow us a reasonable time to address vulnerabilities before public disclosure
• Comply with applicable EU and national law

This safe harbour does not extend to researchers who exploit vulnerabilities maliciously or engage in activities beyond good-faith security testing.

[COMPANY NAME] publishes security advisories for confirmed vulnerabilities at [ADVISORY URL] in CSAF 2.0 format (OASIS Common Security Advisory Framework).

Advisories include:

• CVE identifier (we assist with CVE assignment through [CNAs/CVD Portal])
• CVSS 3.1 and/or 4.0 severity scores
• Affected products and versions
• Remediation guidance and patch links
• Reporter acknowledgment (with permission)

Advisories are published when a patch is available. For severe vulnerabilities, we may publish advisories with workarounds prior to patching.