EN ISO/IEC 29147:2020 PDF

Overview

EN ISO/IEC 29147:2020 (ISO/IEC 29147:2018) - Information technology - Security techniques - Vulnerability disclosure - provides vendor-focused requirements and recommendations for responsibly handling and disclosing vulnerabilities in products and services. The standard’s primary goal is to reduce risk from exploited vulnerabilities by enabling coordinated vulnerability disclosure so users can perform effective technical vulnerability management (see ISO/IEC 27002:2013, clause 12.6.1).

Key topics and requirements

• Vulnerability handling process - guidance on preparation, receipt, verification, remediation development, release, post-release actions and embargo periods.
• Receiving reports - capability to receive and track vulnerability reports, acknowledgement, monitoring and secure communications.
• Verification and investigation - initial assessment, further investigation and ongoing communications with reporters and coordinators.
• Publishing advisories - advisory content and timing requirements, including advisory elements such as identifiers, date/time, title, overview, affected products, and intended audience.
• Stakeholder roles - defined roles for vendors, reporters, coordinators, and users, and their responsibilities in coordinated disclosure.
• Confidentiality and secure exchange - recommendations for protecting sensitive information while coordinating remediation.
• Policy and techniques - considerations for creating a vulnerability disclosure policy and practical techniques; illustrative examples are provided in Annex A (techniques/policies) and Annex B (communications).
• Relationship to other standards - describes how disclosure activities relate to ISO/IEC 30111 (vulnerability handling/testing) and ISO/IEC 27002 (information security practices).

Applications and who should use it

• Vendors and product teams - to establish or improve a formal vulnerability disclosure policy and process for products, services, and components.
• Security/PSIRT teams - to standardize report intake, verification workflows, advisory publication, and communication with researchers and customers.
• Incident response and CSIRTs - to coordinate multi-vendor disclosures and reduce cross-product exploitation risk.
• Security researchers and coordinators - to understand vendor expectations for report format, timelines, and confidentiality.
• Risk and compliance managers - as part of broader vulnerability management aligned with ISO/IEC 27002 and organizational risk reduction.

Related standards

• ISO/IEC 30111 - technical processes between receiving and disclosing vulnerability reports (testing and remediation handling).
• ISO/IEC 27002 - information security controls and vulnerability management context (clause 12.6.1).

EN ISO/IEC 29147:2020 is essential reading for organizations aiming to implement coordinated vulnerability disclosure, publish clear vulnerability advisories, and reduce exploitation risk across products and services.