Do ISO/IEC 29147 and 30111 have to be done together?

Setting them up as a pair is advisable: CRA vulnerability obligations cover both outward disclosure and internal handling, and doing them separately tends to leave audit gaps at the hand-over.

We are a small company. Do we need a dedicated product security team?

Not necessarily a large one, but you do need a clear reporting channel, an owner and a response process.

Is there a new edition of ISO/IEC 29147?

A revision has been registered in ISO/IEC JTC 1/SC 27: the third edition of ISO/IEC 29147 was registered as a work item on 8 October 2025, and the working draft revising ISO/IEC 30111 combines vulnerability handling and disclosure in one standard. No new edition has been published yet; the current editions remain ISO/IEC 29147:2018 and ISO/IEC 30111:2019.

How to choose an ISO/IEC 29147 consultant in Taiwan: eight criteria

Direct answer: the first question to ask an ISO/IEC 29147 consultant is "when an outside researcher or a customer finds a vulnerability in your product, can they find where to report it, and how soon will they hear back?" ISO/IEC 29147 sets out how a vendor receives vulnerability reports, coordinates with the people who report them, and publishes remediation advisories; it is the outward-facing side of coordinated vulnerability disclosure (CVD). What happens after a report arrives (verification, prioritisation and remediation) is covered by ISO/IEC 30111, and the two should be set up as a pair. Next, check whether the consultant can connect it to the EU CRA. Annex I, Part II of the CRA (Regulation (EU) 2024/2847) requires manufacturers to put in place and enforce a policy on coordinated vulnerability disclosure (point 5), to provide a contact address for reporting vulnerabilities (point 6), and to publicly disclose information about fixed vulnerabilities once a security update is available (point 4). The Article 14 reporting obligations apply from 11 September 2026: an actively exploited vulnerability needs an early warning within 24 hours of becoming aware of it, a notification within 72 hours and a final report within 14 days after a corrective or mitigating measure is available, submitted through the ENISA single reporting platform to the CSIRT designated as coordinator and to ENISA at the same time. The CRA itself does not name ISO/IEC 29147; the 2024 standards-mapping analysis by the EU Joint Research Centre (JRC) and ENISA found that EN ISO/IEC 29147 maps to four of the eight vulnerability handling requirements in Annex I, Part II (points 2, 4, 5 and 6).

How 29147 and 30111 divide the work

Standard	What it covers	Typical outputs
ISO/IEC 29147 (vulnerability disclosure)	Outward: receiving reports, communicating with reporters, publishing advisories	Reporting channel and security.txt, coordinated disclosure policy, advisory template
ISO/IEC 30111 (vulnerability handling)	Inward: verification, prioritisation, root-cause analysis, remediation and release	Handling process, prioritisation criteria, handling records and time limits

Eight criteria

Criterion	Question you can ask any consultant
Reporting channel	How will outsiders find our reporting channel? Will it be published with security.txt?
Acknowledgement and response times	How soon after a report do we acknowledge it and report progress? Who is responsible?
Coordinated disclosure policy	What commitments and expectations does the policy state? What is our position on good-faith researchers?
Advisories and remediation information	What goes into an advisory, through which channel is it published, and when?
Vulnerability identifiers	When needed, how do we obtain a CVE ID?
Link to 30111	How are reports received from outside handed over to the internal handling process, and how is status reported back to the reporter?
EU CRA mapping	Can you map us point by point against the eight requirements in CRA Annex I, Part II? 29147 maps to points 2, 4, 5 and 6; what covers the SBOM (point 1), security testing and review (point 3) and secure update distribution (point 7)? Who handles Article 14 reporting?
Who leads, and is work subcontracted	Who actually runs the engagement, with what qualifications? Will any of it be subcontracted?

When you may not need a consultant

If your products do not go to the EU market and no customer asks for a coordinated disclosure policy, you can start by publishing a reporting channel and a simple handling commitment yourself, based on ISO/IEC 29147. If your products fall under the CRA, the reporting obligations already apply, and a complete, rehearsed process is advisable.

How Winners Consulting addresses these criteria

What follows is Winners Consulting's own description. Test us with the questions above, just as you test other consultants.

Reporting channel: set up security.txt and a reporting mailbox or form
Acknowledgement and response times: set time limits for acknowledging and responding to reports
Coordinated disclosure policy: write a coordinated vulnerability disclosure policy (including a safe-harbour statement)
Advisories and remediation information: set up an advisory template and publication process, and help apply for CVE IDs when needed
Link to 30111: connect outward disclosure to the internal vulnerability handling process
Hands-on experience: Winners Consulting runs its own vulnerability monitoring and compliance evidence chain, so the advice comes from practical implementation
Who leads: vice-president and director-level consultants run the whole engagement; nothing is subcontracted

Compliance needs all three; a consultant's value is integration

CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.

Dimension	The question it answers	Typical gap when only this part is done
Process (management system)	Who is responsible, what is done, when, where the evidence is, how it improves	Tools are in place but nobody runs them on schedule, so there are no records at audit time
Security technology	How controls are designed and how their effectiveness is verified	Documents are complete but the systems do not actually do what they describe
Legal compliance	Which regulation applies, which role you hold, the deadlines and penalties	Controls are built against the wrong regulation or role, so obligations are not covered

Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.