magnifying icon Basket
1 item ^

Basket is empty
Login

Login

LOGGED AS

Help

Satisfaction enquiry

SATISFACTION ENQUIRY

Newsletter

Free of charge lifelong learning "Standardization"

FREE OF CHARGE LIFELONG LEARNING "STANDARDIZATION"

Standardisation

Draft standards in public enquiry

DRAFT STANDARDS IN PUBLIC ENQUIRY

Standards organizations

STANDARDS ORGANIZATIONS

  • National standards

  • European standards

  • International standards


Deliverable

 
Free preview
Price
Language
 
ILNAS-EN ISO/IEC 29147:2020 Edition 05/2020
Information technology - Security techniques - Vulnerability disclosure (ISO/IEC 29147:2018)
  •   
  •   
  •   
  •  
  • 49.3 / copy
  •  
 

Abstract

This document provides requirements and recommendations to vendors on the disclosure of vulnerabilities in products and services. Vulnerability disclosure enables users to perform technical vulnerability management as specified in ISO/IEC 27002:2013, 12.6.1[1]. Vulnerability disclosure helps users protect their systems and data, prioritize defensive investments, and better assess risk. The goal of vulnerability disclosure is to reduce the risk associated with exploiting vulnerabilities. Coordinated vulnerability disclosure is especially important when multiple vendors are affected. This document provides: — guidelines on receiving reports about potential vulnerabilities; — guidelines on disclosing vulnerability remediation information; — terms and definitions that are specific to vulnerability disclosure; — an overview of vulnerability disclosure concepts; — techniques and policy considerations for vulnerability disclosure; — examples of techniques, policies (Annex A), and communications (Annex B). Other related activities that take place between receiving and disclosing vulnerability reports are described in ISO/IEC 30111. This document is applicable to vendors who choose to practice vulnerability disclosure to reduce risk to users of vendors' products and services.

Status

Standard - Active

Origin

Technical Committee :
CEN/CLC/JTC 13 : Cybersecurity and Data Protection

Implementation

start of the vote on the project    09/01/2020   date of ratification (dor)    03/05/2020
end of the vote on the project    02/04/2020   date of anouncement (doa)    31/08/2020
start of the vote on the final project    22/03/2021   date of publication (dop)    30/11/2020
end of the vote on the final project    17/05/2021   date of withdrawal (dow)    30/11/2020


Publication Official Journal
of the Grand-Duchy of Luxembourg
16/11/2020
Reference Mémorial A N° 903

International Classification for Standards (ICS codes) :

35.030 : IT Security

magnifying icon Basket
1 item ^

Basket is empty


Warning:
DIN standards can be downloaded only once! After downloading, they are no longer available in the eLibrary.
Begin download?