> For the complete documentation index, see [llms.txt](https://docs.medcrypt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.medcrypt.com/medcrypt-documentation/medisao/manage-coordinated-vulnerability-disclosures.md). # Manage coordinated vulnerability disclosures **CVD Management** is where your organization triages vulnerability reports about your devices and keeps the person who reported each one informed. Coordinated vulnerability disclosure (CVD) means a researcher reports a vulnerability privately so you can fix it before it's made public. FDA expects manufacturers to have a process for receiving and handling these reports. ## Before you begin * Your organization's plan must include MedISAO. * Reports reach your list in two ways: MedISAO assigns a report submitted through its own form to your organization, or a researcher submits through your organization's branded disclosure portal (see [Set up your own disclosure portal](#set-up-your-own-disclosure-portal)). {% hint style="warning" %} **The reporter can see your activity.** Status changes, TLP changes, and comments you add appear in the **Activity History** on the reporter's status page, along with the name of the person who made them. Write every comment as if you were sending it to the reporter. {% endhint %} ## Review your disclosures 1. In the sidebar, select **CVD Management**. The table lists every disclosure assigned to your organization. 2. Use these columns to decide what to open first: | Column | What it shows | | ------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **MANUFACTURER** / **PRODUCTS** | What the reporter says is affected. | | **SEVERITY** | The severity and the CVSS score the reporter gave, if any. CVSS is the standard 0.0 to 10.0 severity scale. | | **AI IMPORTANCE** | An automatic triage rating: **Critical**, **High**, **Medium**, or **Low**. A spinner means the evaluation is still running. **Evaluation Failed** means it didn't complete. | | **TLP** | How widely the report may be shared (see [Change the TLP level](#change-the-tlp-level)). | | **STATUS** | Where the report is in the process (see below). | | **SUBMITTED** | When the report arrived. | 3. Select a row to open the disclosure's details. **AI IMPORTANCE** helps you sort through high volumes of reports, including low-effort, machine-generated ones. Treat it as a starting point for triage. It doesn't replace your own review. ### Statuses | Status | Meaning | | ---------------------------------------------------------------- | --------------------------------------------- | | **Intake** | Received; not yet passed to the manufacturer. | | **Submitted** (shown as **Submitted to Manufacturer** on badges) | Passed to the manufacturer for action. | | **Rejected** | Not accepted as a valid vulnerability. | | **Fixed** | The vulnerability has been fixed. | | **Handled** | Dealt with and closed. | ## Read a disclosure The details panel shows the manufacturer and products, the severity, AI importance, TLP, and status badges, followed by: * **Description:** The reporter's full write-up. * **Reporter Email:** Select it to email the reporter. * **Assigned Organization:** The organization the report is assigned to. * **Any Injuries Reported:** **Yes** or **No**, as stated by the reporter. * **AI Analysis:** Tools for a deeper look (see below). * **Activity History:** Every status change, TLP change, assignment, and comment, with who made it and when. ## Analyze a disclosure with AI To check a report against your own documentation, give the analysis your device documents first. 1. In **AI Analysis**, select **Collections**. The number in brackets shows how many collections are attached. 2. In **Manage Collections**, select **Attach** next to each document collection that's relevant, such as your design documents or threat model. Select **Detach** to remove one. 3. Close the panel and select **View Analysis**. 4. In the **CVD Analysis** window, use the **Chat** tab to ask about the disclosure, request an analysis, or have it draft comments. If the analysis produces a document, it opens on the **Editor** tab, where you can edit it. 5. Select **Close** when you're done. The conversation is saved so you can come back to it. ## Update a disclosure The buttons at the bottom of the details panel record your decisions. Each one adds an entry to the **Activity History**. ### Change the status 1. Select **Change Status**. 2. Choose the **New Status**. 3. Enter a **Comment** explaining why. A comment is required. 4. Select **Change Status**. ### Change the TLP level TLP (Traffic Light Protocol) marks how widely the report's details may be shared. New reports start at **TLP:RED**. 1. Select **Change TLP**. 2. Choose the **New TLP Level**: * **TLP:WHITE:** Public information * **TLP:GREEN:** Community disclosure * **TLP:AMBER:** Limited disclosure * **TLP:RED:** Restricted to recipients only 3. Enter a **Comment** explaining why, and select **Change TLP Level**. ### Add a comment Select **Add Comment**, enter your comment, and select **Add Comment**. Use comments to ask the reporter for details or to tell them about progress. ### Extend the reporter's access The reporter's status link expires. If the report is still open when the link is close to expiring, extend it. 1. Select **Extend Access**. This button appears only when the reporter has a status link. 2. Enter an **Extension Period (days)** between 1 and 360. The period counts from today, not from the current expiry date. The window shows the **Current Expiration** and the **New Expiration**. 3. Select **Extend Access**. ## Set up your own disclosure portal Organization admins can publish a branded disclosure form at your organization's own web address. Reports submitted there are routed directly to your organization's **CVD Management** list. 1. Select **Settings**, then the **Manage Organization** tab. 2. Under **Vulnerability Disclosure Portal**, fill in: * **Display name** and **Portal URL slug**, the last part of the portal's web address (lowercase, hyphenated) * **Primary color**, **Accent color**, and **Logo** (PNG or JPEG, up to 2 MB) * **Intro text (optional)**, which replaces the default introduction, and **Support email (optional)** 3. Turn on **Portal enabled (publicly accessible)**. 4. Check the **Preview**, then select **Save Portal Settings**. 5. Select **Copy portal URL** and publish the link wherever researchers look for your disclosure policy, such as your website's security page. ## Next steps * [Share advisories and remediations through VIPER channels](/medcrypt-documentation/medisao/share-through-viper-channels.md): once a disclosure is **Fixed** or **Handled**, turn it into an advisory for hospitals. * [Report a vulnerability](/medcrypt-documentation/medisao/report-a-vulnerability.md): see the form and status page the reporter uses. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.medcrypt.com/medcrypt-documentation/medisao/manage-coordinated-vulnerability-disclosures.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.