Coordinated vulnerability disclosure (CVD)
Anyone who finds a flaw should be able to report it to the manufacturer, the manufacturer should fix it, and then it is published. This interplay is called coordinated disclosure. The Cyber Resilience Act requires every manufacturer to have a policy for it.
Coordinated vulnerability disclosure (CVD) is the orderly process in which third parties report vulnerabilities to the manufacturer, the manufacturer fixes them and both agree on publication. The Regulation requires a written policy for this.
Definition in the Regulation
Annex I, Part II, point (5), of Regulation (EU) 2024/2847 requires manufacturers to "put in place and enforce a policy on coordinated vulnerability disclosure". Article 13(8), sixth subparagraph, repeats the obligation. Recital 76 describes the purpose: a structured process through which the manufacturer can diagnose and remedy a vulnerability before details are disclosed to third parties; reports should be possible directly to the manufacturer or anonymously via the CSIRT, and bug bounty programmes are expressly permitted. Under recital 68, vulnerabilities discovered through good faith testing and disclosure are not subject to mandatory notification under Article 14. Under Article 16(2), an ongoing CVD process can delay the onward dissemination of a notification via the platform. The obligation applies from 11 December 2027.
What it means for manufacturers
The Regulation does not prescribe the content; the benchmarks are the standards ISO/IEC 29147 and 30111 and, in Germany, BSI TR-03183-3, section 4.4. According to these, the policy should cover the scope, the reporting channels and a commitment not to take legal action against reporters who follow the rules (safe harbour). It should also waive any non-disclosure agreement, promise a first response within five working days and a detailed response within ten, and provide for publication within 90 days, extendable in agreement with the CSIRT. A note that actively exploited vulnerabilities are additionally reported under Article 14 belongs in it as well. A bug bounty programme is recommended, not mandatory. The policy should be dated and reviewed every year.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit