Vulnerability response and disclosure policy

Vulnerability response and disclosure policy

VU-01 — Vulnerability response policy

[Organisation] receives, assesses and responds to vulnerability information affecting its systems and supported products. The vulnerability owner maintains the intake route, assessment records, treatment decisions and communication. The process covers weaknesses discovered internally, reported by external parties or announced for suppliers and dependencies.

Response priorities consider actual exposure, exploitability, affected stakeholders, available mitigations and operational consequences. A published severity score is an input, not the complete decision. The owner records the organisation’s response periods and escalation criteria at [location], including who can decide on extensions or continued exposure.

VU-02 — Public reporting information

Security issues affecting [products or services] can be reported to [security contact and secure submission route]. Include the affected product or service, version if known, a description of the issue, conditions needed to reproduce it and the potential effect. Provide only the information necessary to explain the issue and use the agreed secure route for sensitive material.

[Organisation] will acknowledge reports within [period] and provide an initial status or request for further information within [period]. The reporting contact will coordinate subsequent updates and disclosure arrangements with the reporter. Product support scope and relevant end-of-support information are available at [location]. This reporting route does not itself grant permission to test systems; any testing authority is established separately through the applicable agreement or published testing terms.

VU-03 — Intake and triage

The intake owner records the report, receipt time, source, affected scope and available evidence. Sensitive details are protected under the information policy. The owner checks whether the issue concerns an active incident, a product vulnerability, an operational misconfiguration or another matter, and routes it while preserving the original report.

The assessor determines whether the reported condition can be confirmed, which versions and configurations are affected, and what access or circumstances are required. Duplicate reports are linked without losing contributor information. An unconfirmed report remains identified as unconfirmed, with the next investigation action and owner. Evidence of active exploitation is referred promptly through the incident response arrangements.

VU-04 — Determine exposure and priority

The owner uses the system and component inventories to identify affected deployments, customers and dependencies. The assessment considers reachable paths, privileges, information at risk, essential functions and existing controls. It records any uncertainty in component identification or supplier information. The owner assesses consequences for people and operations alongside technical severity.

The risk owner determines priority using the approved criteria and records treatment deadlines, escalation and interim measures. Where a deadline cannot be met, the authority receives the current exposure, options and proposed decision. A vulnerability is not marked resolved merely because a compensating measure reduces one attack path.

VU-05 — Treat and verify

The engineering owner prepares a fix or other treatment through the change process. Work identifies the root cause, affected variants, regression implications and the supported versions requiring action. The owner considers whether the same weakness may exist elsewhere in the codebase, build process or dependency use. The treatment plan includes delivery and adoption by affected operators or customers.

Verification confirms the intended treatment on the affected configuration and checks relevant existing behaviour. Results identify the scope tested and any remaining exposure. The release record connects the fix to build and artefact identities. Closure for an internally operated system includes deployment evidence; availability of a fixed release alone does not establish that affected deployments were updated.

VU-06 — Communicate and disclose

The owner maintains communication with the reporter and relevant suppliers or coordinators. Disclosure planning considers affected parties’ need to protect themselves, availability of a treatment, active exploitation and agreed coordination arrangements. The record identifies who approves public communication and the reasons for the timing decision.

Advisories state affected products and versions, impact, conditions, available fixes or mitigations and remaining limitations. Instructions identify the action users need to take and how to confirm the result. Sensitive details are shared through the appropriate route while the organisation maintains an accurate public account of material product limitations. Supplier notifications are checked against actual local exposure before closure.

VU-07 — Learn and monitor

The owner reviews root causes and patterns across reports, including weaknesses in requirements, design, coding, review, testing and supplier management. Improvement actions are assigned to the process owner and assessed for effectiveness. Metrics distinguish report receipt, assessment, treatment availability, deployment and verified closure so that a fast acknowledgement is not confused with a fast fix.

At [schedule], the reviewer checks open reports, missed response periods, unsupported versions, treatment evidence and coordination commitments. The owner reviews the reporting route for continued availability and ensures staff can route a report received outside it. Historical records remain linked to affected releases and disclosures under the evidence retention schedule.

Vulnerability record: [VU ID; received; source; security contact]
Affected scope: [Products; versions; configurations; deployments]
Condition and evidence: [Weakness; prerequisites; observations; confidence]
Exposure and decision: [Consequences; priority; deadlines; risk authority]
Treatment: [Change; interim measures; fix; verification; deployment]
Communication: [Reporter/supplier updates; advisory; disclosure decision]
Closure: [Evidence; remaining exposure; root cause; improvement actions]