Coordinated disclosure policy

The obligation

Annex I, Part II, point 5 requires putting in place and enforcing a coordinated vulnerability disclosure policy. Both verbs matter: a policy that is published but whose reports go unanswered does not satisfy the requirement.

Point 6 adds the provision of a contact address, and Annex II requires a single point of contact in the information to the user, with an indication of where it is located.

What a CVD policy contains

Section	Content
Scope	Products, versions and domains covered — and what is not
Out of scope	Third-party systems, customer test environments, defect types not handled
Reporting channel	Dedicated address, form, public encryption key
Acknowledgement	Committed interval — three working days is common practice
Response interval	Time to a first qualified assessment
Disclosure interval	The agreed window before publication — 90 days is the reference practice, adjustable
Safe harbour	For good-faith research within scope
Recognition	Credit in the advisory, acknowledgements page
Reward	Where applicable, scale and conditions
Internal process	What happens after receipt, and the escalation point
Languages accepted	At minimum French and English

The safe harbour commitment

This is the most sensitive clause, and the one that determines whether researchers will report anything to you at all.

It commits the company not to bring civil or criminal action against a person who, in good faith:

• stays within the announced scope;
• does not exfiltrate data beyond what is strictly necessary to demonstrate the issue;
• does not degrade the availability of the service;
• does not disclose before the agreed window;
• reports through the stated channel.

It must be approved by Legal before publication, and drafted precisely: a vague clause is useless to the researcher and dangerous for the company.

The security.txt file

Standard RFC 9116, published at /.well-known/security.txt:

Contact: mailto:[email protected]
Expires: 2027-08-19T00:00:00Z
Encryption: https://example.org/pgp-key.txt
Preferred-Languages: fr, en
Policy: https://example.org/en/security/
Acknowledgments: https://example.org/en/security/#acknowledgements
Canonical: https://example.org/.well-known/security.txt

The trap. The Expires field must stay in the future. An expired security.txt is a visible signal of neglect, and it is routinely picked up by external assessment tools. Its update must be automated, not entrusted to a calendar reminder.

Reference standards

• ISO/IEC 29147 — vulnerability disclosure: how to receive and publish.
• ISO/IEC 30111 — vulnerability handling: how to investigate and fix.

Referring to them explicitly in the policy strengthens its credibility and helps with customer questionnaires.

The French route

Article L. 2321-4 of the French defence code allows a person acting in good faith to pass information about a vulnerability to ANSSI, which preserves the confidentiality of their identity. It is a route open to researchers independently of your policy.

Practical consequence: a researcher may go through ANSSI rather than through you. Better that your channel be the simpler and more reliable of the two.

The internal process

Step	Target interval	Owner
Acknowledgement	3 working days	PSIRT
Initial qualification	7 days	PSIRT + engineering
Qualified response to the researcher	10 days	PSIRT
Fix or reasoned position	Per the SLAs	Engineering
Coordinating the publication date	Before publication	PSIRT + researcher
Publishing the advisory	When the fix is available	PSIRT
Acknowledgement of the researcher	At publication	PSIRT

Every report received is entered in a register, whether or not it is accepted. That register is the evidence that the policy is “enforced” and not merely “put in place”.

Should you become a CVE Numbering Authority?

For	Against
Control over the publication schedule	A commitment to quality and responsiveness
Consistent identifiers across your products	A permanent process load
Credibility with researchers and customers	Exposure: your publications become countable
Easier correlation for your customers	Requires a genuinely staffed PSIRT

The question is only usefully asked once the CVD process is running and the volume of reports is significant. Asking it too early diverts attention from the real issue, which is answering reports within the intervals you announced.

The public page

Your policy is published at Vulnerability disclosure. It must be accessible without authentication, at a stable URL, and referenced from security.txt and from each product’s documentation.