> For the complete documentation index, see [llms.txt](https://docs.medcrypt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.medcrypt.com/medisao/manage-coordinated-vulnerability-disclosures.md).

# Manage coordinated vulnerability disclosures

**CVD Management** is where your organization triages vulnerability reports about your devices and keeps the person who reported each one informed. Coordinated vulnerability disclosure (CVD) means a researcher reports a vulnerability privately so you can fix it before it's made public. FDA expects manufacturers to have a process for receiving and handling these reports.

## Before you begin

* Your organization's plan must include MedISAO.
* Reports reach your list in two ways: MedISAO assigns a report submitted through its own form to your organization, or a researcher submits through your organization's branded disclosure portal (see [Set up your own disclosure portal](#set-up-your-own-disclosure-portal)).

{% hint style="warning" %}
**The reporter can see your activity.** Status changes, TLP changes, and comments you add appear in the **Activity History** on the reporter's status page, along with the name of the person who made them. Write every comment as if you were sending it to the reporter.
{% endhint %}

## Review your disclosures

1. In the sidebar, select **CVD Management**. The table lists every disclosure assigned to your organization.
2. Use these columns to decide what to open first:

   | Column                          | What it shows                                                                                                                                                                |
   | ------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
   | **MANUFACTURER** / **PRODUCTS** | What the reporter says is affected.                                                                                                                                          |
   | **SEVERITY**                    | The severity and the CVSS score the reporter gave, if any. CVSS is the standard 0.0 to 10.0 severity scale.                                                                  |
   | **AI IMPORTANCE**               | An automatic triage rating: **Critical**, **High**, **Medium**, or **Low**. A spinner means the evaluation is still running. **Evaluation Failed** means it didn't complete. |
   | **TLP**                         | How widely the report may be shared (see [Change the TLP level](#change-the-tlp-level)).                                                                                     |
   | **STATUS**                      | Where the report is in the process (see below).                                                                                                                              |
   | **SUBMITTED**                   | When the report arrived.                                                                                                                                                     |
3. Select a row to open the disclosure's details.

**AI IMPORTANCE** helps you sort through high volumes of reports, including low-effort, machine-generated ones. Treat it as a starting point for triage. It doesn't replace your own review.

### Statuses

| Status                                                           | Meaning                                       |
| ---------------------------------------------------------------- | --------------------------------------------- |
| **Intake**                                                       | Received; not yet passed to the manufacturer. |
| **Submitted** (shown as **Submitted to Manufacturer** on badges) | Passed to the manufacturer for action.        |
| **Rejected**                                                     | Not accepted as a valid vulnerability.        |
| **Fixed**                                                        | The vulnerability has been fixed.             |
| **Handled**                                                      | Dealt with and closed.                        |

## Read a disclosure

The details panel shows the manufacturer and products, the severity, AI importance, TLP, and status badges, followed by:

* **Description:** The reporter's full write-up.
* **Reporter Email:** Select it to email the reporter.
* **Assigned Organization:** The organization the report is assigned to.
* **Any Injuries Reported:** **Yes** or **No**, as stated by the reporter.
* **AI Analysis:** Tools for a deeper look (see below).
* **Activity History:** Every status change, TLP change, assignment, and comment, with who made it and when.

## Analyze a disclosure with AI

To check a report against your own documentation, give the analysis your device documents first.

1. In **AI Analysis**, select **Collections**. The number in brackets shows how many collections are attached.
2. In **Manage Collections**, select **Attach** next to each document collection that's relevant, such as your design documents or threat model. Select **Detach** to remove one.
3. Close the panel and select **View Analysis**.
4. In the **CVD Analysis** window, use the **Chat** tab to ask about the disclosure, request an analysis, or have it draft comments. If the analysis produces a document, it opens on the **Editor** tab, where you can edit it.
5. Select **Close** when you're done. The conversation is saved so you can come back to it.

## Update a disclosure

The buttons at the bottom of the details panel record your decisions. Each one adds an entry to the **Activity History**.

### Change the status

1. Select **Change Status**.
2. Choose the **New Status**.
3. Enter a **Comment** explaining why. A comment is required.
4. Select **Change Status**.

### Change the TLP level

TLP (Traffic Light Protocol) marks how widely the report's details may be shared. New reports start at **TLP:RED**.

1. Select **Change TLP**.
2. Choose the **New TLP Level**:
   * **TLP:WHITE:** Public information
   * **TLP:GREEN:** Community disclosure
   * **TLP:AMBER:** Limited disclosure
   * **TLP:RED:** Restricted to recipients only
3. Enter a **Comment** explaining why, and select **Change TLP Level**.

### Add a comment

Select **Add Comment**, enter your comment, and select **Add Comment**. Use comments to ask the reporter for details or to tell them about progress.

### Extend the reporter's access

The reporter's status link expires. If the report is still open when the link is close to expiring, extend it.

1. Select **Extend Access**. This button appears only when the reporter has a status link.
2. Enter an **Extension Period (days)** between 1 and 360. The period counts from today, not from the current expiry date. The window shows the **Current Expiration** and the **New Expiration**.
3. Select **Extend Access**.

## Set up your own disclosure portal

Organization admins can publish a branded disclosure form at your organization's own web address. Reports submitted there are routed directly to your organization's **CVD Management** list.

1. Select **Settings**, then the **Manage Organization** tab.
2. Under **Vulnerability Disclosure Portal**, fill in:
   * **Display name** and **Portal URL slug**, the last part of the portal's web address (lowercase, hyphenated)
   * **Primary color**, **Accent color**, and **Logo** (PNG or JPEG, up to 2 MB)
   * **Intro text (optional)**, which replaces the default introduction, and **Support email (optional)**
3. Turn on **Portal enabled (publicly accessible)**.
4. Check the **Preview**, then select **Save Portal Settings**.
5. Select **Copy portal URL** and publish the link wherever researchers look for your disclosure policy, such as your website's security page.

## Next steps

* [Share advisories and remediations through VIPER channels](/medisao/share-through-viper-channels.md): once a disclosure is **Fixed** or **Handled**, turn it into an advisory for hospitals.
* [Report a vulnerability](/medisao/report-a-vulnerability.md): see the form and status page the reporter uses.