[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso\u002F29147":3},{"item":4,"lessons":16,"controls":66,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso","29147","ISO\u002FIEC 29147","ISO\u002FIEC 29147: Vulnerability disclosure",17,"International Organization for Standardization (ISO) and IEC","**What it covers.** An international standard giving guidance to vendors on receiving reports of potential vulnerabilities in their products and services and on publishing information about resolved vulnerabilities. It complements ISO\u002FIEC 30111, which covers handling vulnerabilities internally.\n\n**In practice.** Applying it well means offering a clear and public way to report vulnerabilities, such as a disclosure policy and a contact point, acknowledging reports promptly and communicating with reporters during investigation. When fixes are ready, advisories are published with enough information for users to act. Evidence includes the published policy, report handling records and advisories.\n\n**Common gaps.** Typical gaps are no visible reporting channel, slow or no responses to reporters and advisories that lack actionable detail. This is increasingly relevant under the EU Cyber Resilience Act.",null,"https:\u002F\u002Fwww.iso.org\u002Fisoiec-27001-information-security.html","See the standard at ISO","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"google-adjusts-chrome-bug-bounty-rewards-amid-ai-driven-threat-evolution","Google Adjusts Chrome Bug Bounty Rewards Amid AI-Driven Threat Evolution","2026-10-13T18:20:47.688+00:00",{"slug":23,"title":24,"published_at":25},"flock-safety-becomes-cna-can-vendors-self-police-their-own-vulnerabilities","Flock Safety Becomes CNA: Can Vendors Self-Police Their Own Vulnerabilities?","2026-10-13T00:20:25.004+00:00",{"slug":27,"title":28,"published_at":29},"automated-noise-overwhelms-googles-bug-bounty-program","Automated Noise Overwhelms Google's Bug Bounty Program","2026-10-05T16:21:27.854+00:00",{"slug":31,"title":32,"published_at":33},"ai-spam-overwhelms-bug-bounty-programs-forcing-google-to-pause-oss-vrp","AI Spam Overwhelms Bug Bounty Programs, Forcing Google to Pause OSS VRP","2026-10-05T10:20:51.138+00:00",{"slug":35,"title":36,"published_at":37},"eu-cyber-resilience-act-article-14-reporting-now-mandatory-for-digital-product-makers","EU Cyber Resilience Act Article 14 Reporting Now Mandatory for Digital Product Makers","2026-09-23T12:22:02.053+00:00",{"slug":39,"title":40,"published_at":41},"ai-powered-tools-are-flooding-vendors-with-bug-reports-and-theyre-not-ready","AI-Powered Tools Are Flooding Vendors With Bug Reports — And They're Not Ready","2026-09-04T14:21:03.096+00:00",{"slug":43,"title":44,"published_at":45},"silent-patch-and-delayed-disclosure-enabled-multi-chain-cosmos-evm-exploit","Silent Patch and Delayed Disclosure Enabled Multi-Chain Cosmos EVM Exploit","2026-08-28T22:20:24.78+00:00",{"slug":47,"title":48,"published_at":49},"silent-patches-leave-defenders-blind-while-attackers-exploit-early","Silent Patches Leave Defenders Blind While Attackers Exploit Early","2026-08-25T10:20:19.759+00:00",{"slug":51,"title":52,"published_at":53},"nato-and-ai-startup-gain-authority-to-assign-cve-ids-expanding-global-vulnerability-tracking","NATO and AI Startup Gain Authority to Assign CVE IDs, Expanding Global Vulnerability Tracking","2026-08-10T20:20:18.158+00:00",{"slug":55,"title":56,"published_at":57},"hidden-security-fixes-in-safety-recalls-expose-critical-infrastructure-risks","Hidden Security Fixes in Safety Recalls Expose Critical Infrastructure Risks","2026-08-07T10:20:18.861+00:00",{"slug":59,"title":60,"published_at":61},"github-restructures-bug-bounty-quality-over-quantity-shifts-researcher-incentives","GitHub Restructures Bug Bounty: Quality Over Quantity Shifts Researcher Incentives","2026-07-22T22:21:39.823+00:00",{"slug":63,"title":64,"published_at":65},"building-effective-coordinated-vulnerability-disclosure-programs","Building Effective Coordinated Vulnerability Disclosure Programs","2026-07-15T16:22:19.34+00:00",[67,72,77,82,87,92],{"slug":68,"name":69,"problem":70,"stories":71},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",9,{"slug":73,"name":74,"problem":75,"stories":76},"patch-management","Automated patch management","Known holes get closed in days, not months.",6,{"slug":78,"name":79,"problem":80,"stories":81},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",3,{"slug":83,"name":84,"problem":85,"stories":86},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",2,{"slug":88,"name":89,"problem":90,"stories":91},"breach-attack-simulation","Breach and attack simulation","You only find out whether your security tools stop an attack when a real attacker tries.",1,{"slug":93,"name":94,"problem":95,"stories":91},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[97,103,108,114,120,125,130,134],{"family":98,"item":99,"code":100,"title":101,"together":102},"cis","7","Control 7","Continuous Vulnerability Management",16,{"family":5,"item":104,"code":105,"title":106,"together":107},"30111","ISO\u002FIEC 30111","ISO\u002FIEC 30111: Vulnerability handling processes",15,{"family":109,"item":110,"code":111,"title":112,"together":113},"nist-csf","id-ra","ID.RA-1","Risk Assessment",11,{"family":115,"item":116,"code":117,"title":118,"together":119},"nist-sp","800-40","SP 800-40","SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology",10,{"family":115,"item":121,"code":122,"title":123,"together":124},"800-61","SP 800-61","SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management",5,{"family":126,"item":127,"code":128,"title":129,"together":124},"gdpr","32","Article 32","Security of processing",{"family":115,"item":131,"code":132,"title":133,"together":124},"800-216","SP 800-216","SP 800-216: Recommendations for Federal Vulnerability Disclosure Guidelines",{"family":98,"item":135,"code":136,"title":137,"together":138},"16","Control 16","Application Software Security",4]