ISO/IEC-5895 › Cybersecurity - Multi-party coordinated vulnerability disclosure and handling
The following bibliographic material is provided to assist you with your purchasing decision:
This document clarifies and increases the application and implementation of ISO/IEC 30111 and ISO/IEC 29147 in multi-party coordinated vulnerability disclosure (MPCVD) settings, including the evolving commonly adopted practices in this area, by articulating:
. The MPCVD life cycle and application of coordinated vulnerability disclosure (CVD) stages (preparation, receipt, verification, remediation[1] development, release, post-release) in MPCVD settings.
. Stakeholders involved in MPCVD include users, vendors (coordinating, mitigating, and dependent vendors), reporters, and non-vendor coordinators (entities defined in ISO/IEC 29147 and ISO/IEC 30111).
. The exchange of information between stakeholders during the vulnerability handling and disclosure process in a MPCVD settings.
Clarifying the application of ISO/IEC 30111 and ISO/IEC 29147 in MPCVD settings illustrates the benefits of vulnerability disclosure processes.
[1] Remediation is a defined term used in ISO/IEC 30111 and ISO/IEC 29147. This document uses the term "remediation" and verb .remediate. in the context of this definition.
To find similar documents by classification:
35.030 (IT Security Including encryption)
This document comes with our free Notification Service, good for the life of the document.
This document is available in either Paper or PDF format.
Document Number
ISO/IEC TR 5895:2022
Revision Level
1ST EDITION
Status
Current
Publication Date
June 1, 2022
Committee Number
ISO/IEC JTC 1/SC 27