Cyber Resilience Act Response Center Request a demoDemo

Guide Last updated 12 min read

Coordinated vulnerability disclosure policy (CVD policy): what it must contain

Anyone who finds a vulnerability wants to know how the manufacturer will deal with it: where to report, what happens next, whether there will be trouble. The coordinated vulnerability disclosure policy answers those questions. The Cyber Resilience Act requires one, and BSI TR-03183-3 sets out what goes into it.

A coordinated vulnerability disclosure policy (CVD policy) is a public document. In it, a manufacturer explains how it handles vulnerability reports from outside: where to report, what the reporter can expect, what the manufacturer expects of the reporter, and when the vulnerability will be published. Annex I, Part II, point (5) of Regulation (EU) 2024/2847 requires manufacturers to "put in place and enforce a policy on coordinated vulnerability disclosure", but does not say what it must contain. In Germany, section 4.4 of the BSI's Technical Guideline TR-03183-3 sets out the minimum content: confidentiality, response times, no criminal complaint where the reporter follows the rules, no obligation to sign a non-disclosure agreement, anonymous reports, publication within 90 days.

Key points

  • Annex I, Part II, point (5) requires the policy, and Article 13(8) the procedures behind it, for products placed on the market from 11 December 2027.
  • Recital 76 encourages a machine-readable policy and an anonymous reporting channel, and allows for reward programmes. None of these is mandatory.
  • Section 4.4 of BSI TR-03183-3 sets out the minimum content: confidentiality, response times of 5 and 10 working days, safe harbour, no NDA requirement, four-eyes principle, annual review. It recommends a hall of fame but does not require one.
  • The policy does not replace the reporting obligation: under Article 14, an actively exploited vulnerability must also be notified to the CSIRT and ENISA within 24 hours.
  • The manufacturer reports vulnerabilities in bought-in components to the component's manufacturer (Article 13(6)).

Where is the obligation set out, and when does it apply?

Annex I, Part II, point (5) requires manufacturers to "put in place and enforce a policy on coordinated vulnerability disclosure". The sixth subparagraph of Article 13(8) requires appropriate policies and procedures to "process and remediate" reported vulnerabilities. Annex I, Part II, point (4) requires manufacturers, once a security update has been made available, to publish information about the fixed vulnerability: a description, the products affected, the impact, the severity and guidance for users; publication may be delayed until users have had the chance to apply the update. According to the Commission guidance C(2026) 5252, these obligations apply to products placed on the market from 11 December 2027. Manufacturers should nevertheless prepare the policy now, because the reporting obligation under Article 14 has applied since 11 September 2026 and depends on reports arriving in an orderly way.

Two recitals explain the intention. Recital 76 describes coordinated vulnerability disclosure as a structured process that allows the manufacturer to remedy a vulnerability before details are disclosed to third parties. Reports should be possible directly to the manufacturer or, where requested, anonymously via the national CSIRT; manufacturers should consider publishing the policy in machine-readable format, and should be able to run reward programmes (bug bounties). Recital 68 makes clear that vulnerabilities discovered "with no malicious intent for purposes of good faith testing, investigation, correction or disclosure" should not be subject to mandatory notification under Article 14. That is the link: a working coordinated disclosure process produces findings that the manufacturer fixes without an early warning notification becoming due, as long as there is no sign of exploitation.

Which standards and guidelines underpin it?

TR-03183-3 brings existing standards together. ISO/IEC 29147:2018 covers outward-facing disclosure: receiving reports, dealing with reporters, publishing security advisories. ISO/IEC 30111:2019 covers internal handling: investigation, remediation, release. A harmonised standard, prEN 40000-1-3, is in preparation but has not yet been published in the Official Journal. There is also the BSI's guideline on the CVD process (version 1.0, 1 December 2022). It gives manufacturers a deadline for closing a reported vulnerability, within the internationally customary range of 45 to 90 days and agreed with the security researchers, and the BSI mediates when a process stalls.

What minimum content does TR-03183-3 require?

Section 4.4 of the TR lists what a policy must contain:

  • Form (4.4.1): date of last change visible, clearly attributable to the manufacturer, annual review.
  • Contact (4.4.3): the psirt@ and csirt@ mailboxes with keys, as in the security.txt file.
  • Commitments to reporters (4.4.4): confidentiality; no disclosure of personal data without consent; responses within the guaranteed times; no criminal complaint as long as the policy is followed (safe harbour, except where criminal intent is evident); a hall of fame entry on request (recommended, not mandatory); no requirement to sign a non-disclosure agreement (NDA).
  • What counts as a vulnerability (4.4.5): it concerns one of the manufacturer's own products or its own infrastructure; the manufacturer may exclude pure scanner output without evidence. The TR recommends using only these criteria; examples such as missing HTTP headers or DMARC notices without evidence of an impact illustrate the third criterion and are not additional exclusions (see Spam in the security mailbox).
  • Code of conduct (4.4.6, optional): no attacks, no tampering with third-party systems, no trading in exploits. If the reporter breaches it, they only lose the reward and the acknowledgement; the report is still handled.
  • Communication (4.4.7): accept an e-mail address and a telephone number as the reporter's contact details, welcome status enquiries, apply the four-eyes principle when closing a case.
  • Deadlines (4.4.8): first response within 5 working days, detailed response within 10 working days.
  • Anonymous reports (4.4.9): accepted, with a note that the manufacturer cannot then ask follow-up questions.
  • Disclosure (4.4.10): within 90 days, extendable once by 90 days in agreement with the national CSIRT, at least in the European Vulnerability Database (EUVD). The manufacturer arranges publication there in agreement with the national CSIRT or ENISA; it does not make the entry itself.
  • End of the process (4.4.11): clearly defined end states, such as fixed and published, or reporter unreachable for 30 days.
  • Active exploitation (4.4.2): inform the national CSIRT without delay.

The TR recommends a reward programme but does not require one.

How is a policy structured?

The twelve-point outline covers the TR's requirements. It is not a template to copy, but the list of questions a manufacturer has to answer for itself. The CVD generator on security-txt.eu produces a draft with the minimum content and your addresses.

Free toolGenerate a CVD policyAlongside the security.txt file, generates a draft policy in Markdown with the minimum content under TR-03183-3, section 4.4, and your addresses and deadlines.Generate a draft
  1. ScopeWhich products, versions and services the policy covers, plus the manufacturer's own infrastructure; and what is excluded, such as installations at customer sites or third-party systems.
  2. Reporting channelsThe psirt@ and csirt@ addresses with keys, the web form with an anonymous option, the languages (German and English) and a reference to the security.txt file. In addition, the contact details you accept from reporters; under the TR, at least an e-mail address and a telephone number.
  3. What we expect from reportersThe code of conduct: no data exfiltration, no denial-of-service attacks, no disclosure before coordination. Plus the information needed: product, version, steps to reproduce, impact.
  4. What we commit toThe safe harbour: no criminal complaint where the reporter follows the rules (waiving civil action as well goes beyond the TR and is voluntary), confidentiality, no non-disclosure agreement, protection of the reporter's data. There is no statutory safe harbour in Germany; the policy therefore frames the commitment as a declaration of intent by the manufacturer, not as a legal guarantee. It has limits: the manufacturer can only permit testing of its own systems, not of customer installations or third-party systems. And where there is a special public interest, the public prosecutor can investigate on its own initiative, even without a request for prosecution from the injured party (section 205(1) of the German Criminal Code, Strafgesetzbuch, StGB). A reform of section 202a StGB is still being examined by the Federal Ministry of Justice (Bundestag printed paper 21/5456, April 2026).
  5. Process and deadlinesA personal first response, not an auto-reply (TR: 5 working days), feedback after the assessment (10 working days), status updates, the four-eyes principle when closing. Only promise deadlines you can keep when people are away.
  6. AssessmentWhich CVSS version is used to rate severity, and how duplicates and known vulnerabilities are handled.
  7. CoordinationWhen CERT-Bund is brought in as an intermediary, and how vulnerabilities in bought-in components are passed to the component's manufacturer (Article 13(6)).
  8. DisclosureThe 90-day rule with extension, the format of the security advisory (CSAF), the assignment of a CVE number, publication in the EUVD, and the timing: after the update, with a delay under Annex I, Part II, point (4).
  9. RecognitionHall of fame, acknowledgement on request, and a reference to a reward programme if there is one.
  10. Closing the processThe defined end states from the TR, so that reporters know when a case is closed and why.
  11. Relationship to the reporting obligationA statement that an actively exploited vulnerability is notified to the CSIRT and ENISA within 24 hours under Article 14, regardless of any ongoing process; under Article 16(2), dissemination of the notification can be delayed while coordinated disclosure is under way.
  12. MetadataVersion, date, person responsible, next review, privacy notice.

What applies to bought-in components?

Article 13(6) requires the manufacturer to report a vulnerability in a bought-in component to the component's manufacturer and to share any fix of its own with it. The Commission guidance clarifies this in paragraphs 222 to 229. The obligation concerns the integrated version, and the manufacturer uses the component manufacturer's reporting channels. A duplicate report is not needed if the component manufacturer already knows; for orphaned components, the obligation does not apply. The policy should describe this route.

What reporters expect

Security researchers read the policy before they report. If it is missing or off-putting, they report to the CSIRT, publish directly or do not report at all. What they look for matches the TR: an address someone actually reads; a response within days; a commitment that no lawyer will come after them; no non-disclosure agreement; an honest deadline for publication. Siemens describes four phases (report, analysis, handling, disclosure), says it usually responds within one working day and maintains a hall of thanks. Bosch acknowledges within two working days, sets out four safe harbour conditions (no damage, no data protection breach, no criminal offence, publication only after the fix is confirmed) and accepts anonymous reports. Neither policy mentions a reward programme.

Common mistakes

  • A policy with no date and no review. The TR requires a visible date of last change and an annual review.
  • No safe harbour, or one that is too narrow. Researchers then steer clear of the policy, and the report reaches the manufacturer by a roundabout route or not at all.
  • A non-disclosure agreement as a precondition. The TR rules this out.
  • Deadlines nobody keeps. Two working days without holiday cover are worse than an honest five.
  • No distinction between "report received" and "vulnerability confirmed". This distinction also determines the point of awareness under Article 14.
  • No rule for third-party components. Then the report under Article 13(6) never happens.
  • Nothing on rewards. If the policy does not say whether there is a reward programme, beg bounty senders will ask. A sentence such as "We do not pay rewards" answers the question in advance.
  • Security advisories only as PDF. The TR recommends machine-readable advisories in CSAF format.

What this means in practice

The policy is a promise. Every point needs someone to keep it: a person who reads the mailbox, one who responds within 5 working days, a second who checks before a case is closed. For a manufacturer of packaging machines with 120 employees, that means defining roles and cover before the policy goes online. The free security.txt generator produces a draft policy that matches the TR. CRA Response Center monitors the published address and classifies every report; anything that could trigger the reporting obligation goes straight to the people responsible. Handling and publication remain with the manufacturer.

Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit

Frequently asked questions

When does the policy become mandatory?

For products placed on the market from 11 December 2027. It makes sense to have one now, because the reporting obligation under Article 14 has applied since 11 September 2026 and depends on how quickly reports arrive.

Do I need a reward programme?

No. Recital 76 says manufacturers should be able to run such a programme, and the TR recommends one. It is not mandatory. Siemens and Bosch do not mention one and maintain a hall of fame instead.

What is safe harbour?

The commitment not to file a criminal complaint against a reporter as long as they follow the policy. Section 4.4.4 of the TR makes it a minimum requirement. Waiving civil action as well goes further and is voluntary. There is no statutory safe harbour in Germany: the commitment only covers the manufacturer's own systems, and where there is a special public interest, the public prosecutor can investigate regardless (section 205(1) StGB).

How long may I wait before publishing?

Under the TR, 90 days, extendable once by 90 days in agreement with the CSIRT. Under Annex I, Part II, point (4), publication follows once the update is available, with a delay until users have had the chance to apply it.

Is a policy in English enough?

The TR requires a language that users and market surveillance authorities can easily understand. For a German manufacturer, that in practice means German and English.

Further reading

Sources

The reporting obligation already applies. Who answers at night at your company?

CRA Response Center monitors your security mailbox, recognises important reports using AI hosted in Germany (your e-mails never go to OpenAI, Anthropic or Google) and alerts your people by SMS and e-mail. EUR 190 per month including VAT. Try it free for 30 days.

Try it free for 30 days