EU Cyber Resilience Act Annex I Part II(5): Coordinated vulnerability disclosure policy

What else in your programme already covers this

This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Annex I Part II vulnerability handling requirements – EU Cyber Resilience Act

• Annex I Part II(1) Identify and document vulnerabilities and components, including an SBOM
• Annex I Part II(2) Address and remediate vulnerabilities without delay, security updates separate from features
• Annex I Part II(3) Effective and regular security testing and review
• Annex I Part II(4) Public disclosure of fixed vulnerabilities
• Annex I Part II(6) Facilitating vulnerability information sharing, with a contact address
• Annex I Part II(7) Secure distribution of updates
• Annex I Part II(8) Dissemination of security updates without delay and free of charge, with advisories