normakte / Disclosure policy template
The CRA requires a coordinated vulnerability disclosure policy and a contact address for vulnerability reports. This template provides both as a starting point: fill in, adapt, publish.
The manufacturer puts in place and enforces a policy on coordinated vulnerability disclosure, facilitates the sharing of information about vulnerabilities and provides a contact address for reporting them. The contact point also belongs in the information for users.
The time frames in the template (acknowledgement, disclosure) are common example values, not legal requirements. Adapt them to your processes. Not legal advice.
Policy, contact point, reports with deadlines and a target page for users in one place – one trial file free until 20.01.2027.
Source. Regulation (EU) 2024/2847, OJ L, 2024/2847 of 20.11.2024. Summarised; only the official text is authoritative. normakte is not legal advice.