National CSIRT as a CVD Hub: Lessons from CERT.PL’s Vulnerability Coordination Cases
summary
CERT.PL describes acting as Poland’s CNA since August 2023, assigning CVEs and publishing over 160 CVE entries in 2025 (about double 2024) while introducing a 90‑day default disclosure window and tooling to automate CVE production. Coordination uses email plus GitHub/Discord/LinkedIn outreach and phone, yet roughly 15–20% unreachable vendors force publication without vendor input; sectoral CSIRTs get looped in for multi‑stakeholder cases and legal footing was clarified this spring.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 3:20Legal basis for CVD
- 10:07Becoming a CNA
- 16:13Pain points in coordination
- 22:12Legal challenges
- 26:22Unimportant software reports
- 28:50Stakeholder engagement
- 30:15Cyber Resilience Act challenges
- 31:51Q&A: Coordination tools
- 36:51Q&A: Vendor disputes
- 38:22Q&A: Scope and reporting
- 41:39Q&A: Advisory publishing
- 43:45Q&A: Out-of-scope cases
related talks
24mCNA Challenges From a National CERT Perspective
58mVulnerability Coordination in the EU
01h 00mCVE Records: The Cybersecurity Glow-Up You Didn’t Know You Needed
34mLightning Talks
24mSecurity Advisories and Vulnerability Prioritization in the Wild
56mCISA’s North Star Vision for the CVE Program
27mEstablishing a Global Community of Practice on Coordinated Vulnerability Disclosure (CVD)
01h 04mOpen Discussion - International Challenges with CVD, CNA, and CVE