Step 1 of 5 in Have I got the day-1 policies?

Next up: security.txt generator

Research: referenced in the ENISA SME CRA Survey 2026.

Read the analysis

CVD Policy Generator

Every manufacturer covered by the EU Cyber Resilience Act needs a publicly available Coordinated Vulnerability Disclosure (CVD) policy. Fill in the fields below and we will generate a ready-to-publish policy — including your PSIRT reporting structure and the statutory 24h / 72h / 14-day reporting timeline that applies from September 2026.

Organisation & contact

Scope & terms

Live preview — cvd-policy.md
# Coordinated Vulnerability Disclosure (CVD) Policy

_[Your company] — last updated 2026-10-25_

[Your company] takes the security of its products and services seriously. We welcome reports from security researchers and the wider community and are committed to handling them in a coordinated and transparent manner, in line with the EU Cyber Resilience Act (Regulation (EU) 2024/2847) and good industry practice.

## 1. Scope

This policy applies to all products, services and online systems operated by [Your company].

## 2. How to report a vulnerability

If you believe you have found a security vulnerability, please contact us:

- **Email:** security@example.com
- **Preferred languages:** English, German

Please include enough information to reproduce the issue: affected product/version, a description of the impact, and step-by-step instructions or a proof of concept.

## 3. What you can expect from us

- We will acknowledge your report within **5 business day(s)**.
- We will keep you informed about our progress as we triage and remediate the issue.
- We aim to remediate confirmed vulnerabilities and coordinate public disclosure within **90 days**, working with you on the timeline where possible.
- With your permission, we are happy to credit you once the issue is resolved.

## 4. Our commitment to you (Safe Harbor)

[Your company] will not pursue or support legal action against researchers who, in good faith, discover and report vulnerabilities in accordance with this policy. We consider security research conducted under this policy to be authorised. Please act in good faith, avoid privacy violations, data destruction and service disruption, and only interact with accounts you own or have explicit permission to test.

## 5. Out of scope

Findings that require physical access, social engineering of our staff, denial-of-service (DoS/DDoS) attacks, or reports from automated scanners without a demonstrable impact are generally considered out of scope.

## 6. Our response & reporting structure (PSIRT)

[Your company] operates an internal Product Security Incident Response Team (PSIRT) that triages reports, coordinates fixes and manages disclosure. Under the EU Cyber Resilience Act, once an **actively exploited vulnerability** is reported through this channel or discovered internally, statutory reporting deadlines apply from September 2026:

- **Within 24 hours:** submit an early warning to the national CSIRT (BSI (Germany)) and ENISA.
- **Within 72 hours:** submit a more detailed notification including an initial technical assessment and available mitigations.
- **Within 14 days of a fix:** submit the final report once a security update (patch) has been made available.

These statutory deadlines complement — and do not replace — the coordinated timeline we agree with the reporter for public disclosure.

---

_This document is a template generated with the free CRA Studio (www.cra-studio.eu) CVD Policy generator. It is not legal advice. Review it with a qualified expert before publishing._

Your CVD process — BPMN view

A shared picture of the workflow your policy describes — reuse it, or keep it as audit evidence.

Start / end eventTaskDecision gatewayCRA Art. 14 step
  1. Reporter / Researcher

    Vulnerability discovered

  2. ↓

    Submit report via security.txt or security@ email

  3. PSIRT / Triage
    ↓

    Acknowledge within 5 business day(s)

  4. ↓

    Valid & reproducible?

    No→ Inform reporter & closeYes→ Assess severity
  5. ↓

    Assess severity & impact

  6. ↓

    Actively exploited or severe incident?

    Yes→ CRA Art. 14 reportingNo→ Standard remediation
  7. Regulatory — CRA Art. 14
    ↓

    24 h — early warning to BSI (Germany) & ENISA

  8. ↓

    72 h — notification: initial assessment & mitigations

  9. ↓

    14 days after fix — final report

  10. Engineering
    ↓

    Develop & test fix

  11. ↓

    Release security update

  12. Coordinated disclosure
    ↓

    Coordinate disclosure within 90 days

  13. ↓

    Publish advisory & credit reporter

  14. ↓

    Case closed

The three-stage reporting roadmap (from Sep 2026)

  • 24 hours: early warning to the national CSIRT (e.g. BSI) and ENISA.
  • 72 hours: detailed triage report with initial technical analysis and mitigations.
  • 14 days after the fix: final report once a patch is available.

Manage this policy in CRA Studio

Store your CVD policy as a Global Policy, link it to your products and track its review dates automatically.

This generator produces an indicative template based on the EU Cyber Resilience Act (Regulation (EU) 2024/2847). It is not legal advice — review the result with a qualified expert before publishing it on your website.