[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso\u002F30111":3},{"item":4,"lessons":16,"controls":66,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso","30111","ISO\u002FIEC 30111","ISO\u002FIEC 30111: Vulnerability handling processes",15,"International Organization for Standardization (ISO) and IEC","**What it covers.** An international standard describing how vendors should handle reports of potential vulnerabilities in their products and services internally, from receipt through verification, remediation development and release. It works together with ISO\u002FIEC 29147 on vulnerability disclosure.\n\n**In practice.** Vendors set up a defined process and team for triage, reproduce and assess reported issues, prioritise by impact, develop and test fixes, and coordinate release with disclosure. Lessons from vulnerabilities feed back into development practices. Evidence includes a documented process, case records with timelines, and links between fixed vulnerabilities and advisories.\n\n**Common gaps.** Common gaps are no owner for incoming reports, fixes released without coordinated advisories, and no analysis of root causes. It is relevant to manufacturers preparing for the EU Cyber Resilience Act.",null,"https:\u002F\u002Fwww.iso.org\u002Fisoiec-27001-information-security.html","See the standard at ISO","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"google-adjusts-chrome-bug-bounty-rewards-amid-ai-driven-threat-evolution","Google Adjusts Chrome Bug Bounty Rewards Amid AI-Driven Threat Evolution","2026-10-13T18:20:47.688+00:00",{"slug":23,"title":24,"published_at":25},"flock-safety-becomes-cna-can-vendors-self-police-their-own-vulnerabilities","Flock Safety Becomes CNA: Can Vendors Self-Police Their Own Vulnerabilities?","2026-10-13T00:20:25.004+00:00",{"slug":27,"title":28,"published_at":29},"automated-noise-overwhelms-googles-bug-bounty-program","Automated Noise Overwhelms Google's Bug Bounty Program","2026-10-05T16:21:27.854+00:00",{"slug":31,"title":32,"published_at":33},"ai-spam-overwhelms-bug-bounty-programs-forcing-google-to-pause-oss-vrp","AI Spam Overwhelms Bug Bounty Programs, Forcing Google to Pause OSS VRP","2026-10-05T10:20:51.138+00:00",{"slug":35,"title":36,"published_at":37},"eu-cyber-resilience-act-article-14-reporting-now-mandatory-for-digital-product-makers","EU Cyber Resilience Act Article 14 Reporting Now Mandatory for Digital Product Makers","2026-09-23T12:22:02.053+00:00",{"slug":39,"title":40,"published_at":41},"ai-powered-tools-are-flooding-vendors-with-bug-reports-and-theyre-not-ready","AI-Powered Tools Are Flooding Vendors With Bug Reports — And They're Not Ready","2026-09-04T14:21:03.096+00:00",{"slug":43,"title":44,"published_at":45},"silent-patch-and-delayed-disclosure-enabled-multi-chain-cosmos-evm-exploit","Silent Patch and Delayed Disclosure Enabled Multi-Chain Cosmos EVM Exploit","2026-08-28T22:20:24.78+00:00",{"slug":47,"title":48,"published_at":49},"silent-patches-leave-defenders-blind-while-attackers-exploit-early","Silent Patches Leave Defenders Blind While Attackers Exploit Early","2026-08-25T10:20:19.759+00:00",{"slug":51,"title":52,"published_at":53},"nato-and-ai-startup-gain-authority-to-assign-cve-ids-expanding-global-vulnerability-tracking","NATO and AI Startup Gain Authority to Assign CVE IDs, Expanding Global Vulnerability Tracking","2026-08-10T20:20:18.158+00:00",{"slug":55,"title":56,"published_at":57},"hidden-security-fixes-in-safety-recalls-expose-critical-infrastructure-risks","Hidden Security Fixes in Safety Recalls Expose Critical Infrastructure Risks","2026-08-07T10:20:18.861+00:00",{"slug":59,"title":60,"published_at":61},"github-restructures-bug-bounty-quality-over-quantity-shifts-researcher-incentives","GitHub Restructures Bug Bounty: Quality Over Quantity Shifts Researcher Incentives","2026-07-22T22:21:39.823+00:00",{"slug":63,"title":64,"published_at":65},"building-effective-coordinated-vulnerability-disclosure-programs","Building Effective Coordinated Vulnerability Disclosure Programs","2026-07-15T16:22:19.34+00:00",[67,72,77,82,87,92],{"slug":68,"name":69,"problem":70,"stories":71},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",7,{"slug":73,"name":74,"problem":75,"stories":76},"patch-management","Automated patch management","Known holes get closed in days, not months.",4,{"slug":78,"name":79,"problem":80,"stories":81},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",3,{"slug":83,"name":84,"problem":85,"stories":86},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",2,{"slug":88,"name":89,"problem":90,"stories":91},"breach-attack-simulation","Breach and attack simulation","You only find out whether your security tools stop an attack when a real attacker tries.",1,{"slug":93,"name":94,"problem":95,"stories":91},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[97,101,107,113,119,124,129,133],{"family":5,"item":98,"code":99,"title":100,"together":9},"29147","ISO\u002FIEC 29147","ISO\u002FIEC 29147: Vulnerability disclosure",{"family":102,"item":103,"code":104,"title":105,"together":106},"cis","7","Control 7","Continuous Vulnerability Management",14,{"family":108,"item":109,"code":110,"title":111,"together":112},"nist-csf","id-ra","ID.RA-1","Risk Assessment",11,{"family":114,"item":115,"code":116,"title":117,"together":118},"nist-sp","800-40","SP 800-40","SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology",9,{"family":114,"item":120,"code":121,"title":122,"together":123},"800-216","SP 800-216","SP 800-216: Recommendations for Federal Vulnerability Disclosure Guidelines",5,{"family":125,"item":126,"code":127,"title":128,"together":123},"gdpr","32","Article 32","Security of processing",{"family":102,"item":130,"code":131,"title":132,"together":76},"16","Control 16","Application Software Security",{"family":134,"item":135,"code":136,"title":136,"together":76},"itil","overview","ITIL"]