MedTech Terms
    The authoritative reference
    All terms
    CybersecurityConnected & Cyber-Physical DevicesCVD

    Coordinated Vulnerability Disclosure

    A documented process for receiving, triaging, and responsibly disclosing security vulnerabilities reported by external researchers.

    Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed September 19, 2026

    Definition

    Coordinated Vulnerability Disclosure (CVD) is the documented process by which a manufacturer accepts vulnerability reports from external researchers, validates and remediates the issues, and publishes advisories - coordinated to give operators time to deploy fixes before attackers exploit them. ISO/IEC 29147:2018 defines the disclosure process and ISO/IEC 30111:2019 defines the internal handling process. FDA, CISA, and ENISA all expect MedTech manufacturers to operate a CVD program.
    What the regulation says
    FDA's 2023 guidance and section 524B both require a CVD process: a public point of contact, a documented intake and triage workflow, a commitment to communicate with reporters, and a process for issuing advisories. The HSCC "Medical Device and Health IT Joint Security Plan" provides MedTech-specific CVD templates. ENISA's CVD policy and CISA's Binding Operational Directive 20-01 set parallel expectations for federal use cases.

    What this means in practice

    A working CVD program needs a published security.txt file or vendor security page, a monitored intake address (security@), an SLA-driven triage process, integration with CAPA, and a coordinated-release plan with affected customers and ISACs. Mature MedTech teams also offer Safe Harbor language so good-faith researchers aren't deterred by legal risk.

    Examples

    • A security researcher discovers a critical vulnerability in a medical infusion pump's firmware and reports it through the manufacturer's publicly listed security contact, initiating their CVD process.
    • Following a vulnerability report, a MedTech manufacturer rapidly validates the finding, develops a patch, and coordinates with affected healthcare providers and relevant ISACs before publicly releasing the security advisory.
    • After successful remediation and deployment of an update, the manufacturer publishes details of the vulnerability and the fix, acknowledging the reporting researcher and informing the broader community to prevent further exploitation.
    Common pitfalls
    • •No published intake channel - researchers default to public disclosure when they can't reach you.
    • •Treating CVD intake as a security-only problem; legal, comms, and clinical-affairs all need playbooks.
    • •Publishing advisories without a working VEX/SBOM bridge so operators know which devices need action.

    Frequently asked questions

    Not required. A bounty can attract more reports but adds program overhead. Most MedTech CVD programs start without a bounty and add one later if researcher engagement justifies it.

    Cross-references

    Used by

    Related terms

    Grouped by theme
    Cited by

    Where this term appears across MedTech Terms.

    Sources

    4 sources

    Sources support the definition or relevant regulatory context, not necessarily every claim on this page. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.

    Tier 1Binding law and standards· 3Tier 2Regulator guidance and consensus· 1
    Link health: 4 verified· last checked 2026-06-20
    ISO/IEC·2FDA·1IETF·1
    1. 1
      ISO/IEC 29147:2018 - Vulnerability disclosure
      Tier 1 Verified
      ISO/IECiso.org
    2. 2
      ISO/IEC 30111:2019 - Vulnerability handling processes
      Tier 1 Verified
      ISO/IECiso.org
    3. 3
      FDA Cybersecurity Guidance (Sept 2023)
      Tier 2 Verified
      FDAfda.gov
    4. 4
      RFC 9116 - security.txt
      Tier 1 Verified
      IETFrfc-editor.org

    Inline markers like [1] jump to the matching reference above.