Explainer on joint guidance from five national agenciesmedium
Someone writes to say they found a flaw in your software. Now what?
On 15 July 2026 five national agencies — CISA and NSA for the United States, JPCERT/CC for Japan, NCSC-NL for the Netherlands and NCSC-UK for the United Kingdom — published joint guidance on building a coordinated vulnerability disclosure programme. The topic looks reserved for large vendors. It is not: it concerns anyone who sells software or runs an online service, a far larger set of companies than those with a page telling you where to write if you find a problem. The guidance sets out what is needed — a public policy, a triage process, remediation, CVE assignment — plus legal safe harbour for reporters. And it says what those too small to carry it alone can do: lean on a national CSIRT.
The message with nowhere to land
Picture the scene. Someone who does not work for you, does not know you and has asked you for nothing finds a defect in your product. They want to tell you. They open your website and look for an address.
What do they find? In most cases: a sales contact form, a customer support address, perhaps a switchboard number. The message lands in a ticket queue, where someone who handles refunds will classify it as a complaint, or in a mailbox nobody reads. Weeks pass. The person who found the problem then has three options: keep pushing, give up, or publish.
The joint guidance published on 15 July 2026 by CISA, NSA, JPCERT/CC, NCSC-NL and NCSC-UK is about not reaching that fork. It is titled Establishing a Coordinated Vulnerability Disclosure Program to Work With Security Researchers, and is addressed to software manufacturers and online service providers.
The four pieces
The document frames a coordinated vulnerability disclosure (CVD) programme around four elements — a list short enough to be taken seriously even by a small company.
- 01Public policy (VDP)where to write, what is in scope, what to expect and how fast
- 02Triagewho receives, who assesses, how you decide if it is real and how serious
- 03Remediationhow you fix it and how you tell the people who must apply the fix
- 04CVEassigning a public identifier, where the conditions are met
The disclosure policy (VDP) is the piece most often missing and the cheapest to build. It is a public document saying: here is where to write, here is what we consider in scope, here is what we will do and how quickly. It does not require a dedicated team. It requires a decision.
Triage is where badly built programmes break. A report left unanswered for a month produces a researcher who stops collaborating, and next time will not write. The guidance stresses response times because the relationship with reporters is, before it is technical, reciprocal.
CVE assignment is the step that turns a private fix into a publicly verifiable fact. Without an identifier the patch exists but your customers do not know to apply it, and nobody can measure their own exposure.
The clause that changes the relationship
The guidance is at its sharpest on legal protection for reporters: it recommends adopting clear safe harbour language protecting researchers acting in good faith within the limits set by the policy.
Why this is central and not a lawyers' detail: whoever finds a vulnerability in an online service found it by doing something that, read with hostile eyes, can resemble unauthorised access. Absent an explicit statement, the person trying to help you is taking a personal risk to do so — and reasonable people facing personal risk with no upside tend to choose silence.
Safe harbour is not generosity: it removes a deterrent that acts only on honest reporters. Those with hostile intent do not read your disclosure policy.
If you are too small, the guidance covers it
The natural objection from a twenty-person company selling a vertical business application is that all this is disproportionate. The guidance anticipates it, and points to a route: leaning on third-party intermediaries — CISA itself or other national CSIRTs — to substitute or supplement the programme.
For the Italian context this has a concrete referent: CSIRT Italia, within the national cybersecurity agency ACN, is the national point of contact for handling and coordinating reports. A small vendor does not have to build a triage and coordination function from scratch: it can state in its policy who to approach, and how.
What to do this week
Check whether you have an address. Open your own website as an anonymous visitor and look for where to report a security problem. If you cannot find it in a minute, you do not have one — and that is not a navigation issue, it is a process issue.
Write a one-page VDP. Scope, contact channel, response times, what not to do (do not exfiltrate data, do not degrade the service, do not disclose before the agreed date), and the protection clause for those who follow the rules. One page written today is worth more than ten pages planned for next quarter.
Decide who answers, by name. Not "the security team" if there is no security team. One person, with a deputy, and a response commitment you are confident you can keep.
Work out the CVE question before you need it. When the first real report arrives will not be a good moment to research how an identifier is requested, who assigns it and what it entails.
One closing note, and it is why this topic sits under enterprise solutions rather than compliance. A disclosure programme is not an obligation: it is an inbound channel for information none of your tools will ever produce. Your monitoring sees what happens inside. An external researcher sees your product the way an attacker sees it — and, unlike the attacker, has decided to tell you.
