1. Intake
- A published security contact.
- Acknowledgement to the reporter within a defined time.
- A ticket created for every report.
2. Triage
- Affected products and firmware versions (use the SBOM).
- Severity and exploitability.
- Is it actively exploited? If yes, start the CRA reporting clock.
3. Report (when required)
- Early warning within 24 hours.
- Detailed notification within 72 hours.
- Final report after the fix or mitigation is available.
4. Fix and release
- Fix on a maintenance branch, reviewed by a second engineer.
- Signed update delivered through the secure update path.
- Advisory for customers with affected versions and mitigations.
5. Learn
Close each case with a short review: what allowed the vulnerability, what slowed the response, and what changes in code or process prevent a repeat. Need help setting it up? See cybersecurity & CRA.