What it covers. An international standard describing how vendors should handle reports of potential vulnerabilities in their products and services internally, from receipt through verification, remediation development and release. It works together with ISO/IEC 29147 on vulnerability disclosure.
In practice. Vendors set up a defined process and team for triage, reproduce and assess reported issues, prioritise by impact, develop and test fixes, and coordinate release with disclosure. Lessons from vulnerabilities feed back into development practices. Evidence includes a documented process, case records with timelines, and links between fixed vulnerabilities and advisories.
Common gaps. Common gaps are no owner for incoming reports, fixes released without coordinated advisories, and no analysis of root causes. It is relevant to manufacturers preparing for the EU Cyber Resilience Act.