scope:

The present document is for companies and organizations of all sizes who want to implement a vulnerability disclosure process. It is not intended to be a comprehensive guide to creating and implementing a vulnerability disclosure process, but instead focuses on the essential steps.

The present document contains generic advice on how to respond to and manage a vulnerability disclosure, a defined triage process, advice on managing vulnerabilities in third party products or suppliers, and an example vulnerability disclosure policy.

NOTE: Organizational programs specifically intended to encourage identification and hunting for vulnerabilities, such as bug bounty, are not specifically addressed by the present document.

This work is complementary to EN ISO/IEC 29147 [i.1], ETSI's own CVD process [i.11] and can be used to support specifications including ETSI EN 303 645 [i.2].