ISO/IEC 30111:2019 Crosswalk
This page is not normative
This page is not considered a core part of the Vultron Protocol as proposed in the main documentation. Although within the page we might provide guidance in terms of SHOULD, MUST, etc., the content here is not normative.
Clause 7 of ISO/IEC 30111:2019 Information technology — Security techniques — Vulnerability handling processes describes a vendor's internal handling process from receipt to post-release. The Vultron Protocol covers the same process from the outside: the Report Management (RM) states a vendor passes through, the Case State (CS) facts it establishes, and the messages it sends to tell the other participants.
The table maps each clause to the explanation page that covers it and to the section of the Vultron Protocol Specification that states the requirement. Transitions are written as the state before and after, with the formal message name in parentheses. The protocol side also names the Embargo Management (EM) state machine, each participant's Participant Embargo Consent (PEC), and the two CS dimensions: vendor aware, fix ready, fix deployed (VFD) and public aware, exploit public, attacks observed (PXA).
| ISO/IEC 30111:2019 Clause | Sub-Clause | Vultron Protocol | Specification |
|---|---|---|---|
| 7.1.1 General | - | The protocol begins when a report reaches a participant. | §3.1 Coordination Model |
| 7.1.2 Preparation | - | Publishing a default embargo and contact channels precedes any case. See Default Embargoes. | §3.2 What a Deployment Looks Like |
| 7.1.3 Receipt | a) Internally found vulnerabilities | The organization that finds the vulnerability is its own Reporter; its RM state moves Start → Received. | §6.1 States, §2.2 Roles |
| b) Externally found vulnerabilities | A Report Submission (RS) from the Reporter moves the vendor Start → Received and sets the CS fact Vendor Awareness. | §4.1 Report Management Messages, §6.2 Transitions and Guards | |
| c) Publicly disclosed vulnerabilities | As b), and the case is already Public Aware; any participant may report that fact. | §8.2 PXA — Public Aware, Exploit Public, Attacks Observed, §12.4.2 Participant-Agnostic CS Transitions (PXA) | |
| 7.1.4 Verification | a) Initial investigation | Received → Valid (Report Valid, RV) or → Invalid (Report Invalid, RI). | §6.2 Transitions and Guards |
| b) Possible process exit: 1) duplicate | The report is added to the existing case rather than opening a new one. See Case Management Messages. | §4.4 Case Coordination Operations | |
| b) Possible process exit: 2) obsolete product | Invalid → Closed (Report Closed, RC), or Valid → Deferred → Closed. | §6.2 Transitions and Guards | |
| b) Possible process exit: 3) non-security | Invalid → Closed (RC). | §6.2 Transitions and Guards | |
| b) Possible process exit: 4) other vendor | Valid → Accepted (Report/Case Accepted, RA), and the other vendor is brought into the case. See Working with Others. | §11.2 Invitation and Acceptance | |
| c) Root cause analysis | Work done in the Accepted state. | §6.1 States | |
| d) Further investigation | Work done in the Accepted state. | §6.1 States | |
| e) Prioritization | Valid → Deferred (Report/Case Deferred, RD) or → Accepted (RA). The SSVC crosswalk shows one prioritization scheme. | §4.1 Report Management Messages, §6.2 Transitions and Guards | |
| f) Inform reporter | The RV, RI, RA and RD messages above are sent to the case, so the Reporter learns the outcome. | §4.1 Report Management Messages, §5.4.2 Routing Topology | |
| 7.1.5 Remediation development | all | In the Accepted state, the Vendor works toward Fix Ready and announces it (Case Fix Ready, CF). See Fix Ready. | §8.1 VFD — Vendor Aware, Fix Ready, Fix Deployed, §12.4.1 Participant-Specific CS Transitions (VFD) |
| 7.1.6 Release | - | Publication moves the case to Public Aware (Case Public, CP); an embargo still in force is a reason to terminate it. See Early Termination and Embargo Principles. | §8.2 PXA — Public Aware, Exploit Public, Attacks Observed, §7.2 Transitions and Guards |
| 7.1.7 Post-release | all | A Deployer announces Fix Deployed (Case Fix Deployed, CD); participants close their part of the case (Report Closed, RC). | §8.1 VFD — Vendor Aware, Fix Ready, Fix Deployed, §12.4.1 Participant-Specific CS Transitions (VFD), §6.2 Transitions and Guards |
| 7.2 Process monitoring | all | Any participant may report that an exploit is public or attacks are observed; the CASE_MANAGER decides whether the case adopts the report. See The Case Manager and the Case Ledger. | §12.4.2 Participant-Agnostic CS Transitions (PXA), §10.3 Status Adoption: The Two-Seam Model |
| 7.3 Confidentiality | - | Embargo Management and each participant's embargo consent. | §7 Embargo Management (EM) State Machine, §9 Participant Embargo Consent (PEC) State Machine, §14.4 Confidentiality |
| 8 Supply chain considerations | - | A vendor that depends on an upstream component is a Reporter toward that component's vendor; the case grows by invitation. See RM Interactions Between CVD Participants and Working with Others. | §3.5 Participants and Roles, §11.2 Invitation and Acceptance |