ISO/IEC 30111
Vulnerability handling processes
Overview
Specifies requirements for how vendors should handle vulnerabilities internally, from receipt through remediation and verification. Complements ISO 29147 on disclosure.
Applicability
Internal vulnerability handling and remediation processes
Relevance to Cyber Resilience Act (CRA)
Core standard for CRA vulnerability handling obligations and patch management
Key Coverage Areas
Standard Sections & Chapters
Vulnerability handling process
Metrics and measurement
Receiving vulnerability information
Vulnerability assessment
Remediation
Verification
Release
Related Cyber Resilience Act (CRA) Articles
Article 16: Establishment of a single reporting platform
View Article →Internal vulnerability handling processes
Implementation Guidance:
Implement end-to-end vulnerability handling from intake to remediation and verification
Mapped Obligations:
- ENISA must establish and maintain a single reporting platform for vulnerability and incident notifications
Article 17: Other provisions related to reporting
View Article →Patch release and vulnerability metrics
Implementation Guidance:
Establish processes for timely security patch releases and track metrics
Mapped Obligations:
- ENISA must add publicly known vulnerabilities to the European vulnerability database after fixes are available
Quick Information
- Organization
- ISO/IEC
- Category
- Vulnerability Management
- Certification
- Not available