control
vulnerability disclosure
A published way for outsiders to tell you about a flaw, and a process for what you do with the report. NIS2 names disclosure, and the CRA requires a coordinated disclosure policy and a contact from product makers.
- what it protects
- your name and your customers, by hearing about a flaw from the finder first
- who owns it
- head of IT
- start with
- one address, two readers, one short page on what you accept
what it is
Vulnerability disclosure is the way an outsider tells you about a flaw in your systems or your product, and the way you deal with what they send. People find flaws by accident or on purpose. A clear address and a calm answer decide whether you hear about it first.
NIS2 names vulnerability handling and disclosure as part of security in development and maintenance. The CRA goes further for makers of products: a coordinated disclosure policy, a contact address and public information about fixed vulnerabilities. If you run services and make no products, the NIS2 duty still applies, in a lighter form.
Start with the address and a short page that says what you accept, who reads it and how fast you answer. Then connect it to the people who can fix, and to whoever decides what customers are told.
basis NIS2 Art. 21(2)(e). The page, the address and the reply times are practice.
from a report to a fix
- 1report arrivesat the published address, read by at least two people
- 2receipt confirmedthe reporter hears back and is kept informed
- 3owner and statusan engineer is named, with a date
- 4fixthe flaw is closed, and the case is recorded
- 5who is toldthe reporter and, where it matters, customers
where a report that is being exploited must also reach
- the incident processso the clock for a report starts with the right person
- the engineerswho can fix it
- legalwho has agreed the reply wording
- customerswhere a flaw is serious or has been used
basis working practice. No legal text sets this.
an example
Picture a company of 60 people that sells a web service.
There is no page, only a general mailbox that one person reads when they remember. A researcher writes in, hears nothing for weeks and posts the flaw. The first the engineers hear of it is a customer asking.
A short page names one address read by two people. The reply confirms receipt, each report gets an owner, a status and a date, and legal has agreed the wording in advance. When a flaw is being exploited, the inbox is wired to the incident process and the person who files the report.
An illustration. It is not a real case.
what it has to do for each rule
| rule | where | what the text asks | what the control has to do |
|---|---|---|---|
| NIS2 | NIS2 Art. 21(2)(e) | Security in acquisition, development and maintenance, including vulnerability handling and disclosure. | Publish one address for reports and say who reads it, how fast you reply and how you handle what comes in. |
| IR 2024/2690 | IR 2024/2690 Annex 6.10 | Listed digital providers: vulnerability handling and disclosure. | Write the process down, from first report to fix, and keep the record of each case. |
| CRA | CRA Annex I part II | Manufacturers: a policy on coordinated vulnerability disclosure, a contact address for reports, public information about fixed vulnerabilities and secure distribution of updates. | If you make a product, publish the policy and the address and say what users are told once a fix exists. |
| CRA | CRA Art. 14(1) | Manufacturers report an actively exploited vulnerability in their product: an early warning within 24 hours, a notification within 72 hours and a final report. | Connect the report inbox to the incident process, so a finding that is being exploited reaches the person who files the report. |
basis NIS2 Art. 21(2)(e); IR 2024/2690 Annex 6.10 as a reference; CRA Annex I part II; CRA Art. 14(1). What the control has to do is practice.
what to look for when you choose
- Is there a page on your own site that says where to send a report, what you accept and how you will answer?
- Does the address work and is it read: a shared mailbox read by at least two named people?
- Can a reporter send details in a protected way, for instance with an encryption key or a secure form?
- Does the process say how soon you confirm receipt and how you keep the reporter informed?
- Is there a rule for how long you ask the reporter to wait before publishing, and does it match how long a fix takes?
- Do you say that good-faith research is welcome, in words your lawyer has read?
- How does a report get from the inbox to the engineer who can fix it, and who tells the customers?
- Does the same process cover software you buy, so that your supplier's contact is on file?
basis working practice. No legal text sets this.
three levels, from first step to strong
Each level adds something visible. Stop where the risk you accepted allows.
- start
Choose one address for reports, name two people who read it and publish a short page on what you accept and how you answer.
- solid
Give every report an owner, a status and a date, agree the reply wording with legal and send a test message to the address every quarter.
- strong
Connect the inbox to the incident process, decide in advance who tells customers and keep the contact of every supplier of software you buy on file.
basis working practice. No legal text sets this.
where it goes wrong
an address nobody watches
A report that bounces or sits for weeks teaches the finder to publish instead. Test the address every quarter by sending one.
legal threats in the reply
A person who reports a flaw in good faith and gets a letter from a lawyer will not report the next one. Agree the wording with legal before the first report arrives.
reports with no path to a fix
An inbox that goes only to the security mailbox leaves the engineers out. Give each report an owner, a status and a date.
silence once it is fixed
When a flaw has been used or is serious, customers need to be told. Decide in advance who decides and who writes.
basis working practice. No legal text sets this.
the proof it leaves
| what you can show | who owns it | refresh |
|---|---|---|
| published disclosure policy and the report address | head of IT | yearly |
| the register of reports with status, owner and dates | head of IT | per report |
| result of the test message sent to the address | head of IT | quarterly |
| agreed wording for replies, approved by legal | legal | yearly |
basis practice. The rhythms are your choice.
check it yourself
your next step
Choose one address for reports, name two people who read it and send it a test message.