[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fN_dLREvIl51-w4ef2Rh1rdwsVr1M_zQZblhpj1O6FtU":3},{"article":4,"iocs":42,"watch_terms":43,"solutions":44,"lesson":47},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":29},"c2354878-79b4-4d43-927e-8b4df910090e","Establishing a Coordinated Vulnerability Disclosure Program to Work With Security Researchers","establishing-a-coordinated-vulnerability-disclosure-program-to-work-with-securit-ec3e52","Developed by CISA, the National Security Agency (NSA) and international partners, this joint guidance contains best practices for software manufacturers and online service providers to design and implement a coordinated vulnerability disclosure (CVD) program for working with external security researchers that includes a clear vulnerability disclosure policy (VDP) and process for triaging, remediating and assigning Common Vulnerabilities and Exposures (CVE) identifiers to reported vulnerabilities. The guidance also provides considerations for leveraging third-party intermediaries, like CISA or other national computer security incident response teams, to substitute or supplement a CVD program. By implementing a robust CVD program aligned with this guidance, organizations can work transparently and collaboratively with security researchers to remediate vulnerabilities, build constructive relationships, enhance product security while improving vulnerability management processes, and demonstrate their dedication to protecting customers.","CISA, NSA, and international partners have released joint guidance on establishing Coordinated Vulnerability Disclosure (CVD) programs. The guidance outlines best practices for software manufacturers and online service providers to work with external security researchers, including clear policies for reporting, triaging, and remediating vulnerabilities. It also suggests using third-party intermediaries and highlights the benefits of robust CVD programs for enhancing product security and customer protection.","CISA and NSA release guidance for coordinated vulnerability disclosure programs.","https:\u002F\u002Fwww.cisa.gov\u002Fresources-tools\u002Fresources\u002Festablishing-coordinated-vulnerability-disclosure-program-work-security-researchers",null,"2026-07-15T12:00:00+00:00","2026-07-15T16:00:29.948478+00:00",7,[17,20,22],{"name":18,"type":19},"CISA","vendor",{"name":21,"type":19},"NSA",{"name":23,"type":24},"CVE","technology","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":25,"icon":12,"name":27,"slug":28},"Policy","policy",[30,35,37],{"category":31},{"id":32,"icon":12,"name":33,"slug":34},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":36},{"id":25,"icon":12,"name":27,"slug":28},{"category":38},{"id":39,"icon":12,"name":40,"slug":41},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18,21],{"controls":45,"vendors":46},[],[],{"slug":48,"title":49,"body":50,"framework_refs":51,"framework_notes":62},"building-effective-coordinated-vulnerability-disclosure-programs","Building Effective Coordinated Vulnerability Disclosure Programs","Organizations that lack a formal Coordinated Vulnerability Disclosure (CVD) program miss a critical opportunity to identify and remediate security weaknesses before malicious actors can exploit them. Without clear channels for external researchers to report vulnerabilities, valid findings may go unreported or be disclosed publicly without warning, leaving customers exposed. CISA, NSA, and international partners emphasize that a structured CVD process — covering intake, triage, remediation, and communication — is now a baseline expectation for responsible software manufacturers. Failing to engage the security research community not only increases risk but can also damage customer trust and organizational reputation when vulnerabilities are eventually discovered under less controlled circumstances.",[52,53,54,55,56,57,58,59,60,61],"NIST SP 800-216 (Recommendations for Federal Vulnerability Disclosure Guidelines)","NIST CSF ID.RA-1 (Asset Vulnerabilities Identified and Documented)","NIST CSF RS.CO-5 (Voluntary Information Sharing with External Stakeholders)","CIS Control 7: Continuous Vulnerability Management","ISO\u002FIEC 29147: Vulnerability Disclosure","ISO\u002FIEC 30111: Vulnerability Handling Processes","CISA Binding Operational Directive 20-01","EU Cyber Resilience Act — Article 13 (Vulnerability Handling Requirements)","GDPR Article 32 (Security of Processing — Proactive Risk Management)","FIRST PSIRT Services Framework",{}]