What it covers. An international standard giving guidance to vendors on receiving reports of potential vulnerabilities in their products and services and on publishing information about resolved vulnerabilities. It complements ISO/IEC 30111, which covers handling vulnerabilities internally.
In practice. Applying it well means offering a clear and public way to report vulnerabilities, such as a disclosure policy and a contact point, acknowledging reports promptly and communicating with reporters during investigation. When fixes are ready, advisories are published with enough information for users to act. Evidence includes the published policy, report handling records and advisories.
Common gaps. Typical gaps are no visible reporting channel, slow or no responses to reporters and advisories that lack actionable detail. This is increasingly relevant under the EU Cyber Resilience Act.