Reference

ISO/IEC TR 5895:2022 Crosswalk

This page is not normative

This page is not considered a core part of the Vultron Protocol as proposed in the main documentation. Although within the page we might provide guidance in terms of SHOULD, MUST, etc., the content here is not normative.

ISO/IEC TR 5895:2022 Cybersecurity — Multi-party coordinated vulnerability disclosure and handling is the standard closest to the Vultron Protocol's subject. Multi-party coordinated vulnerability disclosure (MPCVD) is the situation the protocol's case, roles, and embargo model exist for. It describes how several vendors and a coordinator handle one vulnerability together.

The table maps each clause to the explanation page that covers it and to the section of the Vultron Protocol Specification that states the requirement. Transitions are written as the state before and after, with the formal message name in parentheses. The protocol side names the Report Management (RM) and Embargo Management (EM) state machines, each participant's Participant Embargo Consent (PEC), and the two Case State (CS) dimensions: vendor aware, fix ready, fix deployed (VFD) and public aware, exploit public, attacks observed (PXA).

ISO/IEC TR 5895:2022 Clause	Sub-Clause	Vultron Protocol	Specification
4 Concepts	4.2.3 Risk reduction effectiveness	Early Termination and Working with Others.	§10.2 Embargo Revision and Termination Cascades
5 MPCVD scenarios in scope	all	Working with Others; RM Interactions Between CVD Participants.	§3.1 Coordination Model
6 MPCVD stakeholders	all	CVD Roles and Participants.	§2.2 Roles, §12.3 Role Taxonomy
7 MPCVD lifecycle	7.2 Policy development	Default Embargoes; the Report Management Model.	§3.2 What a Deployment Looks Like, §7 Embargo Management (EM) State Machine
	7.3 Strategy development	RM Interactions Between CVD Participants; Embargo Principles.	§3.1 Coordination Model
	7.4 Know your customers	Working with Others; participants are brought in by invitation, and a participant may suggest another.	§11.2 Invitation and Acceptance
	7.5 Encrypted communication methods and conference calls	ActivityPub Implementation. Direct communication between participants is outside the protocol.	§5.6 Transport Layer, §14 Security Considerations
	7.6 Processes and controls	Embargo consent is per participant; see the note on non-disclosure agreements in Embargo Management.	§9 Participant Embargo Consent (PEC) State Machine
8 MPCVD lifecycle for each product	all	Each Vendor tracks its own Fix Ready and each Deployer its own Fix Deployed, while working in the Accepted state.	§8.1 VFD — Vendor Aware, Fix Ready, Fix Deployed, §12.4.1 Participant-Specific CS Transitions (VFD)
9 MPCVD lifecycle for each vulnerability	9.1 Receipt	A Report Submission (RS) moves each recipient Start → Received and sets its Vendor Awareness.	§4.1 Report Management Messages, §6.2 Transitions and Guards
	9.2 Verification	Received → Valid (RV) or → Invalid (RI), then Valid → Accepted (RA) or Deferred (RD). Each outcome is sent to the case.	§6.2 Transitions and Guards
	9.3 Remediation development	The Accepted state; Fix Ready (CF). See Fix Ready.	§8.1 VFD — Vendor Aware, Fix Ready, Fix Deployed, §12.4.1 Participant-Specific CS Transitions (VFD)
	9.4 Release	Publication moves the case to Public Aware (CP); an embargo still in force is a reason to terminate it. See Early Termination.	§8.2 PXA — Public Aware, Exploit Public, Attacks Observed, §7.2 Transitions and Guards
	9.5 Post-release	Fix Deployed (CD); participants close their part of the case (RC).	§8.1 VFD — Vendor Aware, Fix Ready, Fix Deployed, §6.2 Transitions and Guards
	9.6 Embargo period	Embargo Principles; Interactions Between the RM and EM Models; the embargo has not been exited.	§7 Embargo Management (EM) State Machine, §7.3 Relationship to Embargo Consent
10 Information exchange	-	Every case-scoped message is routed through the CASE_MANAGER and recorded in the case ledger. See The Case Manager and the Case Ledger.	§5.4.2 Routing Topology, §4 Semantic Layer — Message Meanings
11 Disclosure	-	Working with Others; the Worked Example; publication (CP).	§8.2 PXA — Public Aware, Exploit Public, Attacks Observed, §10.2 Embargo Revision and Termination Cascades
12 Use case for hardware and further considerations	-	Working with Others; Interactions Between the RM and EM Models.	§11.2 Invitation and Acceptance