We already have an incident response procedure. Why does the CISO still need an ISO/IEC 30111 vulnerability handling process?
Incident handling (ISO/IEC 27035) deals with attacks that have happened; vulnerability handling (ISO/IEC 30111) deals with weaknesses that have been reported. Their triggers, deadlines and outputs differ. An existing incident process is a good base, but CRA audits look for a vulnerability-specific process and evidence.
The response and reporting procedure that listed companies set under Article 34 of the TWSE and TPEx Cybersecurity Control Guidelines for Listed Companies covers the company's own information systems; CRA product vulnerability reporting has to be connected separately to the product-side 30111 process. Companies that are not public companies are not covered by these guidelines and can use them voluntarily.
When a product vulnerability is actively exploited, what are the CISO's statutory reporting deadlines?
Under EU CRA Article 14:
- Through the ENISA single reporting platform: early warning within 24 hours and vulnerability notification within 72 hours; a final report within 14 days after a corrective or mitigating measure is available.
- Applies from 11 September 2026, and also covers products placed on the EU market before 11 December 2027.
The same event may also trigger GDPR, NIS2 or DORA deadlines, each with its own starting point and receiving authority. The response procedure should list them side by side, with one classification step deciding which reports are due. Without an internal process built in advance, the deadlines are hard to meet.
How much of the CRA vulnerability handling requirements does ISO/IEC 30111 cover, and what must be added?
The CRA itself does not name ISO/IEC 30111. In the 2024 JRC and ENISA mapping:
| CRA Annex I Part II | Mapping |
|---|---|
| Points 2, 4, 5, 6 and 8 | Covered by 30111 (29147 covers points 2, 4, 5 and 6 of these) |
| Point 1 SBOM, point 3 regular testing and review, point 7 secure distribution of updates | Covered by neither standard; use other standards or procedures |
The report also notes that no single standard covers every aspect. The mapping is an analysis, not a harmonised standard, and gives no presumption of conformity.
When customers or notified bodies audit vulnerability handling, what evidence does the CISO need to show?
For a CISO, what matters in 30111 is an auditable process and records. Typical outputs:
- Vulnerability handling policy and process documents
- Rating criteria (for example, CVSS criteria adapted to your products)
- Handling records and SLA reporting
- An SBOM linkage procedure
- Interface documents with the 29147 disclosure side
All are built to withstand audits by notified bodies and customers. Common gaps: no product and component list, so impact cannot be judged; rating criteria that live only in someone's experience; and no owner for old versions and discontinued models.
Must vulnerabilities in older products be handled during the support period? How should the CISO assign responsibility?
Yes. The CRA requires manufacturers to handle vulnerabilities effectively under Annex I Part II from placing on the market and throughout the support period (Article 13(8)):
- The support period is at least five years (or the expected use time if shorter), and its end date, at least month and year, must be clearly stated at the time of purchase (Article 13(19)).
- Each security update issued during the support period must remain available for at least 10 years after issue or for the rest of the support period, whichever is longer (Article 13(9)).
The CISO should write an owner and a deadline for every step into the process and SLAs; companies with several product lines also need a cross-line mechanism for assessing vulnerability impact.
How does 30111 share evidence with 29147 and ISO 27001, and how does it go into the board report?
- Paired with 29147: 29147 handles external intake and advisories, 30111 internal handling; the standards reference each other and their processes connect, so implementing them separately leaves audit gaps at the handover.
- On the ISMS: organisations with ISO 27001 can attach the CVD process to the existing ISMS and share documents and audits.
- Board report: Article 37 of the TWSE and TPEx Cybersecurity Control Guidelines for Listed Companies requires regular reporting on cybersecurity to the board or management; applicability decisions, reporting drills and audit results can go into that same report. Companies that are not public companies are not covered by these guidelines and can use them voluntarily.
How does Winners Consulting help a CISO with ISO/IEC 30111?
Winners Consulting's approach (test us with the questions above too):
- VP- and director-level consultants lead in person; nothing is outsourced
- An owner and deadline for every step from intake to release, as an auditable process with SLAs linked to ISO/IEC 27035 and 27036
- An SBOM linkage procedure; Winners' own pipeline generates, signs and monitors SBOMs daily
- 29147 and 30111 implemented as a pair
ISO/IEC 30111 consulting, Choosing a 30111 consultant, Who should lead CRA work. Apply for a free mechanism diagnosis
How other roles see this service
Other services for this role
- CISO implementing ISO 27001: board reporting, the ESG bonus point and certification scope
- CISO on ISO 27701 and GDPR: cross-border data, employee data and the 72-hour notice
- CISO facing NIS2: are we in scope, and how to handle several EU countries, the board and reporting?
- CISO facing DORA: serving EU financial clients, what to prepare for contracts, reporting and testing
- CISO facing the EU CRA: who leads, 24-hour reporting, SBOM and budget
- CISO implementing ISO/IEC 29147: reporting channel, CVD policy and CRA reporting
- CISO guide to IEC 62443: which parts to pursue and how it relates to the EU CRA
- CISO guide to TISAX: assessment level, ISA2027 and timeline
- CISO guide to ISO/SAE 21434: product security beyond TISAX
- CISO guide to ISO 22301: ICT recovery, RTO and exercises
- CISO guide to ISO 42001: what AI governance shares with ISO 27001
- CISO and the EU AI Act: what do AI security, logs and human oversight require?
- CISO and trade secret protection: designing classification and access logs that hold up