--- title: "CVD, Coordinated Vulnerability Disclosure | MedTech Terms" description: "A documented process for receiving, triaging, and responsibly disclosing security vulnerabilities reported by external researchers." lang: en json-ld: | { "@context": "https://schema.org", "@graph": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/cvd#term", "name": "Coordinated Vulnerability Disclosure", "alternateName": "CVD", "description": "Coordinated Vulnerability Disclosure (CVD) is the documented process by which a manufacturer accepts vulnerability reports from external researchers, validates and remediates the issues, and publishes advisories - coordinated to give operators time to deploy fixes before attackers exploit them. ISO/IEC 29147:2018 defines the disclosure process and ISO/IEC 30111:2019 defines the internal handling process. FDA, CISA, and ENISA all expect MedTech manufacturers to operate a CVD program.", "url": "https://medtechterms.com/terms/cvd", "termCode": "cvd", "inDefinedTermSet": { "@type": "DefinedTermSet", "name": "MedTech Terms", "url": "https://medtechterms.com/terms" } }, { "@type": "Article", "@id": "https://medtechterms.com/terms/cvd#article", "headline": "CVD, Coordinated Vulnerability Disclosure", "description": "A documented process for receiving, triaging, and responsibly disclosing security vulnerabilities reported by external researchers.", "url": "https://medtechterms.com/terms/cvd", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://medtechterms.com/terms/cvd" }, "about": { "@id": "https://medtechterms.com/terms/cvd#term" }, "articleSection": "Cybersecurity", "inLanguage": "en", "keywords": "Coordinated Vulnerability Disclosure, CVD, Cybersecurity, medical device, MedTech", "author": { "@type": "Person", "name": "Christian Espinosa", "jobTitle": "Founder, Blue Goat Cyber", "url": "https://bluegoatcyber.com" }, "publisher": { "@type": "Organization", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "isPartOf": { "@type": "WebSite", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "datePublished": "2026-05-05", "dateModified": "2026-05-05", "citation": [ { "@type": "CreativeWork", "name": "ISO/IEC 29147:2018 - Vulnerability disclosure", "url": "https://www.iso.org/standard/72311.html", "publisher": { "@type": "Organization", "name": "ISO/IEC" } }, { "@type": "CreativeWork", "name": "ISO/IEC 30111:2019 - Vulnerability handling processes", "url": "https://www.iso.org/standard/69725.html", "publisher": { "@type": "Organization", "name": "ISO/IEC" } }, { "@type": "CreativeWork", "name": "FDA Cybersecurity Guidance (Sept 2023)", "url": "https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions", "publisher": { "@type": "Organization", "name": "FDA" } }, { "@type": "CreativeWork", "name": "RFC 9116 - security.txt", "url": "https://www.rfc-editor.org/rfc/rfc9116.html", "publisher": { "@type": "Organization", "name": "IETF" } } ], "mentions": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/section-524b#term", "name": "Section 524B of the FD&C Act", "alternateName": "524B", "url": "https://medtechterms.com/terms/section-524b" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/hscc-jsp#term", "name": "HSCC Joint Security Plan", "alternateName": "HSCC JSP", "url": "https://medtechterms.com/terms/hscc-jsp" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/premarket-cybersecurity#term", "name": "Premarket Cybersecurity Submission", "url": "https://medtechterms.com/terms/premarket-cybersecurity" } ] }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechterms.com/" }, { "@type": "ListItem", "position": 2, "name": "Terms", "item": "https://medtechterms.com/terms" }, { "@type": "ListItem", "position": 3, "name": "Cybersecurity", "item": "https://medtechterms.com/terms?cat=Cybersecurity" }, { "@type": "ListItem", "position": 4, "name": "Coordinated Vulnerability Disclosure", "item": "https://medtechterms.com/terms/cvd" } ] }, { "@type": "FAQPage", "@id": "https://medtechterms.com/terms/cvd#faq", "mainEntity": [ { "@type": "Question", "name": "Do we need a bug bounty?", "acceptedAnswer": { "@type": "Answer", "text": "Not required. A bounty can attract more reports but adds program overhead. Most MedTech CVD programs start without a bounty and add one later if researcher engagement justifies it." } }, { "@type": "Question", "name": "What's a security.txt file?", "acceptedAnswer": { "@type": "Answer", "text": "RFC 9116 defines a /.well-known/security.txt file at your domain root listing security contact, disclosure policy, and PGP keys. It is the easiest first step for receivable researcher reports." } }, { "@type": "Question", "name": "When should we publish the advisory?", "acceptedAnswer": { "@type": "Answer", "text": "Coordinate with the reporter and any affected ISAOs. A common default is 90 days after report or upon patch availability, whichever comes first - but adjust by clinical risk." } } ] } ] } --- [ MedTech Terms The authoritative reference ](/) Browse Learn [Latest](/latest) About 1. [Home](/) 2. / 3. [Terms](/terms) 4. / 5. [Cybersecurity](/terms?cat=Cybersecurity) 6. / 7. Coordinated Vulnerability Disclosure [All terms](/terms) Cybersecurity [Connected & Cyber-Physical Devices](/ecosystems/connected-devices)CVD # Coordinated Vulnerability Disclosure A documented process for receiving, triaging, and responsibly disclosing security vulnerabilities reported by external researchers. Reviewed by [Christian Espinosa, Founder, Blue Goat Cyber](/authors/christian-espinosa) Last reviewed May 5, 2026 ## Definition Coordinated Vulnerability Disclosure (CVD) is the documented process by which a manufacturer accepts vulnerability reports from external researchers, validates and remediates the issues, and publishes advisories - coordinated to give operators time to deploy fixes before attackers exploit them. ISO/IEC 29147:2018 defines the disclosure process and ISO/IEC 30111:2019 defines the internal handling process. FDA, CISA, and ENISA all expect MedTech manufacturers to operate a CVD program. What the regulation says FDA's 2023 guidance and section [524B](/terms/section-524b) both require a CVD process: a public point of contact, a documented intake and triage workflow, a commitment to communicate with reporters, and a process for issuing advisories. The HSCC "Medical Device and Health IT Joint Security Plan" provides MedTech-specific CVD templates. ENISA's CVD policy and CISA's Binding Operational Directive 20-01 set parallel expectations for federal use cases. ## What this means in practice A working CVD program needs a published security.txt file or vendor security page, a monitored intake address (security@), an SLA-driven triage process, integration with [CAPA](/terms/capa), and a coordinated-release plan with affected customers and ISACs. Mature MedTech teams also offer [Safe](/terms/safe-note) Harbor language so good-faith researchers aren't deterred by legal risk. Common pitfalls - • No published intake channel - researchers default to public disclosure when they can't reach you. - • Treating CVD intake as a security-only problem; legal, comms, and clinical-affairs all need playbooks. - • Publishing advisories without a working VEX/SBOM bridge so operators know which devices need action. ## Frequently asked questions Do we need a bug bounty? Not required. A bounty can attract more reports but adds program overhead. Most MedTech CVD programs start without a bounty and add one later if researcher engagement justifies it. What's a security.txt file? When should we publish the advisory? ## Cross-references ### Used by Things that build on this term. - [ Section 524B of the FD&C Act(524B) ](/terms/section-524b) ## Related terms Grouped by theme ### Editor's picks · Hand-selected related concepts [ Cybersecurity HSCC Joint Security Plan(HSCC JSP) An industry-developed reference framework from the Healthcare Sector Coordinating Council for end-to-end MedTech cybersecurity. ](/terms/hscc-jsp)[ Cybersecurity Premarket Cybersecurity Submission The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device. ](/terms/premarket-cybersecurity)[ Cybersecurity Section 524B of the FD&C Act(524B) The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices. ](/terms/section-524b) ### More in Cybersecurity · Same category [ Cybersecurity AAMI SW96 AAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle. ](/terms/aami-sw96)[ Cybersecurity AAMI TIR57 AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management. ](/terms/aami-tir57)[ Cybersecurity AAMI TIR97(TIR97) AAMI Technical Information Report on post-market security risk management for medical device manufacturers, the operational companion to TIR57. ](/terms/aami-tir97)[ Cybersecurity Brainjacking Unauthorized remote control of an implanted neurostimulator (e.g., DBS) to alter stimulation parameters and harm a patient. ](/terms/brainjacking) Cited by Where this term appears across MedTech Terms. Ecosystems (1) - [Connected & Cyber-Physical Devices](/ecosystems/connected-devices) ## Primary references 4 sources Link health: 4 verified · last checked 2026-06-20 ISO/IEC· 2 FDA· 1 IETF· 1 1. [1 ISO/IEC 29147:2018 - Vulnerability disclosure Verified ISO/IEC · iso.org ](https://www.iso.org/standard/72311.html) 2. [2 ISO/IEC 30111:2019 - Vulnerability handling processes Verified ISO/IEC · iso.org ](https://www.iso.org/standard/69725.html) 3. [3 FDA Cybersecurity Guidance (Sept 2023) Verified FDA · fda.gov ](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions) 4. [4 RFC 9116 - security.txt Verified IETF · rfc-editor.org ](https://www.rfc-editor.org/rfc/rfc9116.html) Inline markers like \[1\] jump to the matching reference above. Sponsor note ### Working on medical device cybersecurity? Blue Goat Cyber specializes in MedTech cybersecurity - threat modeling, SBOMs, penetration testing, and FDA premarket submissions. [Book a 30-minute discovery session](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) - No obligation - Expert-led from minute one - NDA available on request MedTech Terms is a community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com). Definitions are independent of any vendor. On this term Category Cybersecurity Acronym CVD Sources 4 Updated 5/5/2026 [Compare with another term](/compare?a=cvd) Learn in 60 seconds Card Lesson Quiz A documented process for receiving, triaging, and responsibly disclosing security vulnerabilities reported by external researchers. - · Mature MedTech teams also offer Safe Harbor language so good-faith researchers aren't deterred by legal risk. - · ISO/IEC 29147:2018 defines the disclosure process and ISO/IEC 30111:2019 defines the internal handling process. - · FDA, CISA, and ENISA all expect MedTech manufacturers to operate a CVD program. Remember this Watch out: No published intake channel - researchers default to public disclosure when they can't reach you. Related terms - [Section 524B of the FD&C Act(524B) ](/terms/section-524b) - [HSCC Joint Security Plan(HSCC JSP) ](/terms/hscc-jsp) - [Premarket Cybersecurity Submission ](/terms/premarket-cybersecurity) You may also need Auto-suggested from Cybersecurity and shared keywords. - [Common Vulnerabilities and Exposures(CVE) ](/terms/cve) - [Medhacking ](/terms/medhacking) - [AAMI TIR97(TIR97) ](/terms/aami-tir97) - [ICS Medical Advisory(ICSMA) ](/terms/ics-medical-advisory) - [CISA Known Exploited Vulnerabilities Catalog(KEV) ](/terms/kev) - [Common Vulnerability Scoring System(CVSS) ](/terms/cvss) [All Cybersecurity terms](/terms?cat=Cybersecurity) From the Blue Goat network Related resources and services on this topic. - [ MedTech Cybersecurity Standards Authoritative reference for the standards and guidances behind medical device cybersecurity. ](https://medtechcyberstandards.com) - [ MedTech Cyber Tips Practical, organized tips for medical device cybersecurity teams. ](https://medtechcybertips.com) - [ MedTech Cybersecurity Crosswalk International crosswalk of medical device cybersecurity requirements across regulators. ](https://mdccrosswalk.com) - [ Code Blue Real medical device cybersecurity incidents and their lessons. ](https://codebluechart.com) MedTech Terms An authoritative, plain-language reference for the regulatory, quality, cybersecurity, and software terms that shape modern medical devices. Browse - [All terms](/terms) - [A–Z index](/a-z) - [Categories](/categories) - [Ecosystems](/ecosystems) - [Learning paths](/paths) - [Compare terms](/compare) - [Quiz](/quiz) Resources - [FDA Medical Devices](https://www.fda.gov/medical-devices) - [EU MDR](https://eur-lex.europa.eu/eli/reg/2017/745/oj) - [IMDRF](https://www.imdrf.org/) - [Methodology](/methodology) - [Changelog](/changelog) - [Editor: Christian Espinosa](/authors/christian-espinosa) - [About this site](/about) © 2026 MedTech Terms. Reference content for educational purposes - not regulatory advice. A community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com)