Dutch (original): "Bij of krachtens algemene maatregel van bestuur wordt een CSIRT aangewezen als de coördinator met het oog op een gecoördineerde bekendmaking van kwetsbaarheden." 

English (translation): "By or pursuant to a general administrative order, a CSIRT shall be designated as the coordinator with a view to the coordinated disclosure of vulnerabilities." 

The designated CSIRT coordinator's tasks (Art. 17(2), per secondary summary — not independently re-verified verbatim) include acting as intermediary between reporters and affected manufacturers/providers, identifying and contacting affected entities, and coordinating with counterpart coordinators in other EU Member States.

Transposes NIS2 Article 21(2)(e): "security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure." The amended BSIG requires "besonders wichtige Einrichtungen" (essential) and "wichtige Einrichtungen" (important) entities to implement appropriate and proportionate technical, operational, and organisational measures, including vulnerability handling and disclosure. The BSI is empowered to coordinate vulnerability disclosure and issue public warnings about IT-product vulnerabilities.

ENISA-operated centralized repository of vulnerabilities affecting ICT products/services, mandated by NIS2 Article 12(2). Provides dashboards for critical vulnerabilities, actively exploited vulnerabilities, and EU-coordinated vulnerabilities. ENISA is a CVE Numbering Authority (CNA) since January 2024.

Switzerland’s National Cyber Security Centre (NCSC) established a national Coordinated Vulnerability Disclosure (CVD) framework in December 2022. The framework outlines non-binding but formalized procedures for the intake, triage, and remediation of reported security vulnerabilities. It provides safe harbor protections for good-faith researchers, supports anonymous submissions, and requires initial triage within five business days and remediation within sixty days. The NCSC also acts as a CVE Numbering Authority (CNA) for relevant cases. While participation is voluntary and the framework does not include financial incentives, it encourages the publication of vulnerability disclosure points of contact and fosters alignment with recognized CVD best practices. The framework remains active beyond the duration of the 2022–2025 “Promotion of Ethical Hacking” initiative and reflects Switzerland’s national commitment to structured vulnerability handling and disclosure.

Section 6.4.2 of the ENISA Technical Implementation Guide for NIS2 (v1.0, June 2025) provides non-binding technical guidance on the implementation of Article 21(2)(f) of Directive (EU) 2022/2555 and Annex I, Section 6 of the Implementing Regulation (EU) 2024/2690. It emphasizes the establishment of formal vulnerability handling and disclosure processes, including the adoption of public Vulnerability Disclosure Policies (VDPs) and support for Coordinated Vulnerability Disclosure (CVD). The guidance outlines good practices such as the publication of VDPs on organizational websites, clear communication channels for external reporters, defined response timelines, and alignment with international standards (e.g., ISO/IEC 29147, ISO/IEC 30111). It also includes practical implementation steps and evidence examples for demonstrating conformity during supervision by competent authorities.

The manufacturer shall make a vulnerability disclosure policy publicly available. This policy shall include, at a minimum: 

• contact information for the reporting of issues; and 

• information on timelines for: 1) initial acknowledgement of receipt; and 2) status updates until the resolution of the reported issues.

Provides guidance regarding the "essential steps" companies should take when deciding to implement a VDP. ESTI explicitly states that the document is not intended to a 'comprehensive' guide.