Setting up a coordinated vulnerability disclosure policy

Sooner or later, someone outside your company — a security researcher, a customer, an academic — will find a vulnerability in your product. What happens next depends entirely on whether you have made it easy and safe for them to tell you. A coordinated vulnerability disclosure (CVD) policy is the published set of rules that does exactly that, and the CRA lists having one among the manufacturer's vulnerability-handling duties.

What "coordinated" means

Coordinated disclosure is the middle path between two bad extremes. On one side, full disclosure, where a finder publishes details immediately and users are exposed before a fix exists. On the other, silence, where the finder has no way to reach you and the flaw festers. Coordinated disclosure means the finder reports privately, you fix within a reasonable time, and details become public only once users can protect themselves. Everyone wins — especially your users.

Why the CRA requires it

Annex I's process requirements expect manufacturers to have a policy on coordinated vulnerability disclosure and to provide a contact address for reporting vulnerabilities. It complements the mandatory incident-reporting duties: the CVD policy is how issues reach you in the first place, before they ever become an actively exploited vulnerability you would have to report to the authorities.

What a good CVD policy contains

• A clear point of contact. A monitored security email (e.g. security@yourcompany.com) or a reporting form — and ideally a security.txt file on your website so finders can locate it instantly.
• Scope. Which products, versions and domains the policy covers.
• What to submit. The information you want in a report — affected product/version, reproduction steps, impact.
• Your commitments. That you will acknowledge receipt within a stated time, keep the reporter informed, and work to a remediation timeline.
• Safe-harbour language. A good-faith assurance that you will not pursue legal action against researchers who follow the policy — this is what makes people actually report to you.
• Coordination and credit. How you will handle timing of public disclosure and whether you will credit the finder.

A policy is only half of it — you also need a process

Publishing the policy sets expectations; a process behind it keeps the promise. That means: a triage step to assess and reproduce reports, a way to prioritise by severity, a remediation path that ships a fix, and a follow-up that closes the loop with the reporter and — where appropriate — publishes an advisory. Handled well, disclosures become a free, continuous source of security improvement.

Do it once, for the whole company

Unlike per-product tasks, a CVD policy is naturally an organisation-level asset: one policy, one security contact, applied across your whole product portfolio. Set it up once and it covers everything you make — which is exactly why it is worth doing early.

General information, not legal advice. See Annex I of Regulation (EU) 2024/2847 for the binding vulnerability-handling requirements.