Vulnerability Disclosure and Handling with ISO/IEC 29147 and 30111
Two international standards describe how vendors of products and services should deal with security vulnerabilities. ISO/IEC 29147 (“Vulnerability disclosure”) covers the interface to the people who report vulnerabilities. ISO/IEC 30111 (“Vulnerability handling processes”) covers the internal process that follows. Both are published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). This page explains what each standard requires and how they fit together.
Contents
Why a standardized approach to vulnerabilities matters
Companies and users rely on the security and integrity of IT systems and software. Vulnerabilities in products and services are therefore a serious threat. Their consequences range from the loss of sensitive data to financial damage and loss of reputation. A systematic, standardized approach helps to contain these risks.
ISO/IEC 29147 and ISO/IEC 30111 give vendors guidance and best practices for the entire lifecycle of vulnerability management. ISO/IEC 29147 focuses on the interface between vendors and the people who report vulnerabilities. It defines how vendors should receive reports, communicate with reporters, and publish information about vulnerabilities and remediation. ISO/IEC 30111 adds the internal process for verifying, analyzing, and fixing reported vulnerabilities.
Together, the two standards form a framework for effective vulnerability management. They support constructive cooperation between vendors, security researchers, and users. The shared goal is to detect and fix vulnerabilities quickly and to improve the security of systems continuously.
Applying both standards has several benefits for vendors:
- Clearly defined processes and responsibilities let you handle vulnerabilities efficiently and in a coordinated way.
- Transparent communication builds trust with users and security researchers.
- Recording and analyzing vulnerabilities in a structured way gives you insights to improve the security of your products and services proactively.
The sections below outline the content and requirements of both standards: the roles and responsibilities of the parties involved, the phases of vulnerability management, and best practices for implementation.
How ISO/IEC 29147 and ISO/IEC 30111 work together
ISO/IEC 29147 and ISO/IEC 30111 are two closely related information security standards. Both deal with security vulnerabilities in products and services.
ISO/IEC 29147 (“Vulnerability disclosure”) gives vendors guidance on receiving reports about potential vulnerabilities from external people or organizations. It also covers how to pass information about remediation on to affected users. It describes best practices for communication between vendors and the people who report vulnerabilities.
ISO/IEC 30111 (“Vulnerability handling processes”) complements ISO/IEC 29147. It gives vendors a process for investigating, assessing, and fixing reported vulnerabilities internally. It covers everything that happens after an external reporter or an internal source has reported a vulnerability.
In short, ISO/IEC 29147 deals with the interface between vendors and reporters. ISO/IEC 30111 deals with the vendor's internal processes for verifying, prioritizing, and fixing vulnerabilities.
The two standards interact as follows:
- ISO/IEC 29147 defines how vendors receive vulnerability reports and communicate about them.
- As soon as a report arrives, the processes of ISO/IEC 30111 take over to analyze and fix the vulnerability.
- At the end of this process, the vendor publishes information about the vulnerability and the available patches or workarounds. This step is again covered by ISO/IEC 29147.
Together, the two standards give vendors a structured vulnerability management process, from the report to the fix. They help close vulnerabilities quickly and communicate about them in a controlled way to limit damage. They are important building blocks for trust between vendors, security researchers, and users, and for more secure systems.
Linking external reports to internal processes
In practice, it is often unclear how external vulnerability reports should connect to internal processes. If you want to work out a consistent flow from the report to the fix, a short call is a good starting point.
IEC 62443-4-1 and ISO/IEC 29147 and 30111
IEC 62443-4-1 is an international standard that sets requirements for developing secure products for industrial automation and control systems (IACS). Its focus is the IACS context, but it shares several points of contact with ISO/IEC 29147 and ISO/IEC 30111.
A central element of IEC 62443-4-1 is the requirement for a structured process to manage vulnerabilities in IACS products. Applying the best practices of ISO/IEC 29147 and ISO/IEC 30111 can help you meet these requirements and set up effective vulnerability management.
If you are a manufacturer of IACS products, you can combine the specific requirements of IEC 62443-4-1 with the proven vulnerability management practices of ISO/IEC 29147 and ISO/IEC 30111. This creates a high level of security and trust. It helps you detect potential vulnerabilities early, fix them effectively, and improve product security proactively.
ISO/IEC 29147: guidelines for vulnerability disclosure
ISO/IEC 29147 is an international standard that gives vendors of products and services guidelines for handling vulnerability reports and disclosing vulnerabilities. It describes best practices for communication between vendors and reporters. It also covers the publication of information about vulnerabilities and available remediation.
Terms used in ISO/IEC 29147
The standard first defines the main terms and concepts of vulnerability disclosure. They include:
- Vulnerability: a property of a system or product that violates a security policy and can be exploited by attackers.
- Vendor: the organization or person responsible for fixing a vulnerability, for example the manufacturer or service provider.
- Reporter: a person or organization that informs the vendor about a potential vulnerability. Reporters can be independent security researchers, users, or other vendors.
- Coordinator: an independent party that mediates between reporters and vendors and supports the disclosure process.
Receiving vulnerability reports
A major part of ISO/IEC 29147 deals with how vendors should receive reports about potential vulnerabilities. The standard asks vendors to provide clear and easily accessible ways to submit reports, such as dedicated email addresses, web forms, or bug tracking systems.
Vendors should acknowledge reports promptly and assign the reporter a tracking number or identifier so that the status can be followed. Communication between vendor and reporter should use secure channels to protect the confidentiality of the information.
Publishing security advisories
Once a reported vulnerability has been verified and fixed, vendors should publish information about it in security advisories. ISO/IEC 29147 recommends what these advisories should contain, including:
- a description of the vulnerability and the affected products or versions
- an assessment of the risk and the potential impact
- information about available patches, updates, or workarounds that fix or mitigate the vulnerability
- unique identifiers such as CVE numbers to reference the vulnerability
- contact information for the vendor
Vendors should publish advisories on their website and through other established channels so that users are widely informed. The standard also recommends standardized formats such as the Common Vulnerability Reporting Format (CVRF), which make it easier for security tools and databases to process advisories. The successor to CVRF is the Common Security Advisory Framework (CSAF) 2.0. It has been an OASIS standard since 2022 and has also been published as ISO/IEC 20153 since 2025.
Coordination
Often a vulnerability affects several vendors or products, for example when a flaw is found in a widely used software library or protocol. For such cases, ISO/IEC 29147 gives recommendations on coordination between the parties involved.
Vendors should work with other affected vendors to coordinate how the vulnerability is fixed and disclosed. A coordinator often mediates between the parties. The goal is to publish patches and advisories at about the same time, so that attackers gain no head start.
Vulnerability disclosure policy
A central element of ISO/IEC 29147 is that vendors should publish a vulnerability disclosure policy. This document describes the process for reporting and publishing vulnerabilities in a transparent and traceable way.
The policy should cover at least the following points:
- contact options and preferred channels for reporting vulnerabilities
- expectations regarding the content and form of vulnerability reports
- time frames in which the vendor responds to reports and fixes vulnerabilities
- criteria for publishing security advisories
- handling of confidential information and protection of the reporter's anonymity, if requested
A clear disclosure policy builds trust and encourages security researchers and users to report vulnerabilities responsibly. It is also a strong signal of a vendor's security culture.
What ISO/IEC 29147 achieves
ISO/IEC 29147 is a detailed guide for handling vulnerability reports and disclosing vulnerabilities responsibly. By applying its best practices, vendors can work better with security researchers and users, close vulnerabilities effectively, and raise the security of their products and services.
The standard stresses clear communication, secure reporting processes, and coordination between all parties. A public disclosure policy is a core element for transparency and trust. ISO/IEC 29147 also helps establish a constructive security culture in which vulnerabilities are seen as an opportunity for continuous improvement rather than a threat. This makes it useful for vendors of all industries and sizes that take the security of their products and services seriously.
ISO/IEC 30111: vulnerability handling processes
ISO/IEC 29147 sets the framework for reporting and disclosing vulnerabilities. ISO/IEC 30111 describes the internal processes that vendors should establish to verify, analyze, and fix reported vulnerabilities effectively. It gives recommendations for vulnerability handling from the receipt of a report to the delivery of patches and workarounds.
Principles and responsibilities
The standard first stresses the need for support from top management and for clear policies and responsibilities for vulnerability handling. Handling vulnerabilities requires cooperation between several functions, such as development, cybersecurity, support, and communications. It should be part of the vendor's risk management process.
A central element is a product security incident response team (PSIRT) or a comparable structure. It serves as the central point of contact for vulnerability reports and coordinates the process.
Preparation
According to ISO/IEC 30111, several preparations are needed before vulnerabilities can be handled effectively. They include:
- training and awareness of employees on vulnerability management
- secure communication channels and systems for recording and tracking vulnerability reports
- cooperation with external security researchers, other vendors, and coordinators
- identification of the products and components within the scope of vulnerability management
Receipt and recording
When a vulnerability report arrives, ISO/IEC 30111 calls for prompt documentation and an acknowledgment to the reporter. The report should be checked for completeness and given a unique identifier so that the entire process can be traced. Reports should be treated as confidential from the start to avoid unintentional disclosure of the vulnerability.
Verification and analysis
After a report has been recorded, the verification and analysis phase follows. The goal is to reproduce the reported vulnerability, identify the affected products and versions, and assess the potential impact and severity. PSIRT staff often work closely with the development teams in this phase.
The analysis should also include a root cause analysis to avoid similar vulnerabilities in the future. Based on the results, the vendor decides whether and with what priority the vulnerability will be fixed. Sometimes the issue turns out not to be a security vulnerability but, for example, a functional defect. In that case, too, the reporter should be informed of the outcome.
Developing and testing patches
If a vulnerability has been verified and a fix is needed, the phase of developing and testing patches or updates begins. ISO/IEC 30111 stresses that this process should be planned and carried out carefully. Patches should close the vulnerability itself, be tested thoroughly, and avoid unintended side effects or compatibility problems.
In some cases, it can make sense to provide a workaround or partial fix first, especially when developing a complete patch takes longer.
Releasing patches and information
Once a patch or update has been developed and tested, the next step is to make it available to affected users. This should be coordinated with the publication of information about the vulnerability, as described in ISO/IEC 29147.
Post-release activities
Vulnerability handling does not end with the release of patches and advisories. ISO/IEC 30111 recommends a number of post-release activities:
- monitoring the successful installation of patches
- updating advisories and other information as needed
- reviewing and improving the vulnerability handling process based on the experience gained
- feeding the lessons learned into the secure development lifecycle (SDLC) to improve the security of future products
Ongoing exchange with security researchers and users after a vulnerability has been fixed builds trust and makes vulnerability management more effective.
What ISO/IEC 30111 achieves
ISO/IEC 30111 gives vendors a structured process for handling vulnerabilities, from the first report to the delivery of patches and beyond. It emphasizes clear responsibilities, secure communication channels, and careful analysis and remediation of vulnerabilities.
With the best practices of ISO/IEC 30111, vendors can respond effectively to vulnerability reports. They also gain insights to improve their products and internal processes proactively. Well-functioning vulnerability management strengthens security over the long term.
Together with ISO/IEC 29147, ISO/IEC 30111 forms a complete framework for handling vulnerabilities professionally. Vendors that embed these standards in their organization show their commitment to the security of their products and services. They also take responsibility toward their users and the wider IT community.
What ISO/IEC 29147 and 30111 mean for your products
Professional vulnerability management is no longer only best practice. It is increasingly relevant for regulation as well. If you want to understand what role ISO/IEC 29147 and 30111 play for your products, processes, and regulatory obligations, we can discuss it in a no-obligation call.