Vulnerability Disclosure
What is Vulnerability Disclosure?
The practice of reporting security vulnerabilities to the affected vendor or organisation so they can be patched before being exploited. Responsible disclosure policies define timelines and processes for vulnerability reporting.
Terms that appear alongside vulnerability disclosure
Each of these is named in at least one of the same controls as vulnerability disclosure. The number is how many controls name both.
- vulnerability 44 shared controls
- policy 16 shared controls
- cybersecurity 13 shared controls
- disclosure policy 12 shared controls
- nist 9 shared controls
- cisa 8 shared controls
- incident response 6 shared controls
- cve 6 shared controls
Frameworks that govern vulnerability disclosure
What the standards actually require on vulnerability disclosure
Requirements naming vulnerability disclosure across 6 standards, quoted from the control text.
Manufacturers must put in place and enforce a policy on coordinated vulnerability disclosure.
eu-cyber-resilience-act::Annex I Part II(5) · Coordinated vulnerability disclosure policy →FIRST Information Exchange Policy (IEP) v2.0 + Multi-Party Coordinated Vulnerability Disclosure (MPCVD) Guidelines. IEP v2.0: a machine-readable extension of TLP that conveys handling restrictions + sharing permissions in structured form (JSON-LD).
FIRST-IEP-MPCVD · FIRST Information Exchange Policy (IEP) v2.0 + Multi-Party Coordinated Vulnerability Disclosure (MPCVD) →Run a programme through which researchers can report vulnerabilities with legal safe harbour, and determine the root cause of each report, including whether one of the secure by design practices would have prevented it.
secure-by-design-a-guide-for-manufacturers-cisa::DT-9 · Vulnerability disclosure programmes (SSDF RV.1.3) →A vulnerability disclosure program is implemented to assist with the secure development and maintenance of products and services.
ISM-1616 · Vulnerability disclosure program →CSF 2.0 outcome: processes for receiving, analyzing and responding to vulnerability disclosures are established. Priority Medium. N1: a vulnerability disclosure is a third party reporting a suspected vulnerability in one of the organization's systems.
nist-sp-800-61-rev-3::ID.RA-08 · ID.RA-08 Processes for receiving and acting on vulnerability disclosures →An agency must carry out a risk assessment to decide which of its systems and services the agency VDP (vulnerability disclosure policy) will cover.
new-zealand-information-security-manual-nzism::5.9.23.C.01 · 5.9.23.C.01 Risk assessment to scope the vulnerability disclosure policy →Questions people ask about vulnerability disclosure
What is Vulnerability Disclosure?
Why is Vulnerability Disclosure important for compliance?
Which compliance frameworks address Vulnerability Disclosure?
Where can I learn more about Vulnerability Disclosure?
See how Vulnerability Disclosure applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.