What it covers. NIST recommendations for how US federal agencies should receive, assess, coordinate and disclose vulnerability reports in information systems they operate or rely on. It describes roles such as a vulnerability disclosure programme office and coordination with vendors and reporters.
In practice. It gives a useful model for any organisation: publish a disclosure policy, provide a safe channel for reports, triage and route them to system owners, coordinate with affected vendors and communicate with reporters. Evidence includes the published policy, case handling records and agreed timelines.
Common gaps. Typical gaps are reports that reach no owner, no legal safe harbour language for good faith reporters and poor coordination with third-party vendors. It draws on ISO/IEC 29147 and 30111.