Security · Flashcard
A manufacturer becomes aware of an actively exploited vulnerability at 09:00 on Monday. What is due, and when?
- AAn early warning by 09:00 on Tuesday, and a fuller notification by 09:00 on Thursday
- BA single complete report by 09:00 on Thursday, once the facts have been established
- CAn early warning by 09:00 on Thursday, and a final report fourteen days later
- DA notification to affected customers first, and to the authorities once a fix exists
Why this is the answer
The clock runs from becoming aware: an early warning without undue delay and in any event within 24 hours, then a vulnerability notification with general information and an initial assessment within 72 hours. Waiting to have the full picture is not permitted, the sequence is not reversed, and informing users does not replace the report to the authorities.
Official docs