A researcher or customer finds a vulnerability in our product. What should the CISO have in place first?
Typical deliverables:
- Reporting channel: security.txt and a reporting mailbox or form that outsiders can find.
- Intake and reply SLA: how soon a report is acknowledged, how soon progress is reported, and who owns it.
- CVD policy: commitments and expectations, including a safe-harbour statement.
- Advisories: an advisory template and publication process, and a CVE ID request procedure where needed.
- Handover: connect external intake to the internal ISO/IEC 30111 handling process and report status back to the reporter.
A small company does not need a large team, but it does need a clear channel, an owner and a reply process.
The CRA does not name 29147. How far does the CISO need to go to be credible?
The relevant requirements in Annex I Part II of the CRA: put in place and enforce a CVD policy (point 5), provide a contact address for vulnerability reports (point 6), publish information on fixed vulnerabilities once a security update is available (point 4), and handle and remediate without delay (point 2); a single point of contact must also be designated (Article 13(17)).
The 2024 JRC and ENISA analysis maps EN ISO/IEC 29147 to points 2, 4, 5 and 6 of the eight. Building to the standard is an effective way to explain your approach to customers and conformity assessment bodies, but it creates no presumption of conformity. SBOM (point 1), security testing and review (point 3) and secure distribution of updates (point 7) need other standards or procedures.
How do 29147, 30111 and the product security team (PSIRT) divide the work?
| Standard | Covers | Typical outputs |
|---|---|---|
| ISO/IEC 29147 (disclosure) | External: report intake, communication with reporters, advisories | Reporting channel and security.txt, CVD policy, advisory template |
| ISO/IEC 30111 (handling) | Internal: verification, rating, root cause analysis, remediation and release | Handling process, rating criteria, handling records and time limits |
Build them as a pair: the CRA's vulnerability obligations cover both external disclosure and internal handling, and doing them separately tends to leave audit gaps at the handover. The PSIRT runs both and needs prior authority to report externally.
A reported vulnerability is already being actively exploited. How does CRA reporting connect, and how is it different from internal security incident reporting?
The CRA Article 14 reporting obligations have applied since 11 September 2026, including to products already on the market. Actively exploited vulnerabilities go through the ENISA single reporting platform to the CSIRT designated as coordinator and to ENISA at the same time: early warning within 24 hours of becoming aware, notification within 72 hours, final report within 14 days after a corrective or mitigating measure is available. The platform went live on 11 September 2026.
The response and reporting procedure that listed companies set up under Article 34 of the Cybersecurity Control Guidelines covers incidents in the company's own information systems; the CRA covers vulnerabilities in products. Add a path to the same procedure, with separate triggers and external contacts. Companies that are not public companies are not covered by the guidelines and can use them voluntarily.
An EU customer wants our CVD policy and a PSIRT contact. How should the CISO respond?
This is one of the typical situations calling for 29147. If the customer is a NIS2 entity buying products with digital elements, the CRA's SBOM and vulnerability handling serve as evidence for NIS2 Article 21 supply-chain security.
- Documents you can hand over: a published CVD policy, security.txt, and the intake and reply SLA.
- A process you can explain: how external intake passes to internal handling, how quickly you reply, how advisories are published.
- Reuse the existing system: with ISO 27001 in place, attach the CVD process to the existing ISMS and share documents and audit mechanisms.
If products do not go to the EU and customers have not asked, you can start by publishing a reporting channel and a simple handling commitment.
Which version of ISO/IEC 29147 applies now, and how should the timeline be planned?
The version in force is still ISO/IEC 29147:2018. A third edition was registered as a work item in ISO/IEC JTC 1/SC 27 on 8 October 2025, and the working draft revising ISO/IEC 30111 combines vulnerability handling and disclosure into one standard. The new versions have not been published.
The service page lists no implementation duration, so plan against the CRA dates: Article 14 reporting has applied since 11 September 2026, and the other provisions apply in full from 11 December 2027. If your product is in CRA scope, build and drill the reporting channel and process first.
How does Winners Consulting help a CISO with ISO/IEC 29147?
- Reporting channel: set up security.txt and a reporting mailbox or form, and define intake and reply times.
- Policy and advisories: write the CVD policy with a safe-harbour statement, an advisory template and publication process, and help request CVE IDs where needed.
- As a pair: connect external disclosure to the internal ISO/IEC 30111 handling process.
- One body of evidence: with 27001 in place, attach the CVD process to the existing ISMS.
- Hands-on experience: Winners runs its own vulnerability monitoring and compliance evidence chain, so the guidance comes from real implementation.
- Division of roles: VP- and director-level consultants lead the work end to end, never outsourced.
Read more: ISO/IEC 29147, choosing a 29147 consultant, ISO/IEC 30111, EU CRA. Apply for a free mechanism diagnosis
How other roles see this service
Other services for this role
- CISO implementing ISO 27001: board reporting, the ESG bonus point and certification scope
- CISO on ISO 27701 and GDPR: cross-border data, employee data and the 72-hour notice
- CISO facing NIS2: are we in scope, and how to handle several EU countries, the board and reporting?
- CISO facing DORA: serving EU financial clients, what to prepare for contracts, reporting and testing
- CISO facing the EU CRA: who leads, 24-hour reporting, SBOM and budget
- CISO guide to ISO/IEC 30111: linking vulnerability handling to CRA reporting
- CISO guide to IEC 62443: which parts to pursue and how it relates to the EU CRA
- CISO guide to TISAX: assessment level, ISA2027 and timeline
- CISO guide to ISO/SAE 21434: product security beyond TISAX
- CISO guide to ISO 22301: ICT recovery, RTO and exercises
- CISO guide to ISO 42001: what AI governance shares with ISO 27001
- CISO and the EU AI Act: what do AI security, logs and human oversight require?
- CISO and trade secret protection: designing classification and access logs that hold up
Official sources
- ISO: ISO/IEC 29147:2018 Vulnerability disclosure
- ISO: ISO/IEC AWI 29147 (third edition, under development)
- Regulation (EU) 2024/2847 Cyber Resilience Act (EUR-Lex)
- JRC and ENISA: Cyber Resilience Act Requirements Standards Mapping (2024)
- ENISA: the CRA single reporting platform is launched
- RFC 9116: security.txt