Is it vulnerability handling or management?

[tobie]

Either way, we should strive for consistency in the document title, repo name, etc.

[mrybczyn]

Yes we will need to unify that. I'll check to be in line with the vocabulary of ISO specs, it might be easier for everyone.

[rjb4standards]

NIST has adopted IEC 29147:2018. The CISA Software Acquisition Guide also refers to IEC 29147:2018 for vulnerability disclosure reporting to software users.

[mrybczyn]

@rjb4standards IEC 29147:2018 is a paid standard, and this is a show stopper for many open source projects. And a reason we're developing this specifications (there are other reasons too).

[rjb4standards]

@mrybczyn there are many excellent standards from organizations like IEEE, ISO, IEC and others. Are you saying that a standard will not be considered if it costs a few dollars, like IEC 29147:2018, and others from these fine organizations?

IMO, you will seriously constrain, possibly cripple, the EU CRA standards effort if this constraint remains in place.

[tobie]

@rjb4standards standards referenced normatively will need to meet at least the requirements spelled out in https://opensource.org/osr.

[rjb4standards]

Many ISO, IEC, IEEE and ANSI standards documents are available at a nominal fee.

This requirement will eliminate many viable and broadly adopted standards from consideration, if this constraint is binding:
"Availability: The standard MUST be freely and publicly available (e.g., from a stable web site) under royalty-free terms at reasonable and non-discriminatory cost.

What's more important to the EU Commission, EU CRA standards that are broadly adopted and proven to be effective, but cost a few dollars to obtain the document or free standards documents. It seems short minded to me to limit the standards that the EU CRA will consider to only those documents that are freely available.

[tobie]

This is not an EU Commission or ESO decision, it's a requirement for open source community adoption that we place on the work that we drive, because otherwise that work isn't going to see adoption and hence is a waste of time. This is not open for debate.

[rjb4standards]

@tobie Thanks for clarifying.

My interest in this area is to help identify standards that will be effective for the EU CRA and I am not limiting my guidance on effective standards to only those standards documents that are freely available.

My main objective in participating is to help the EU CRA standards community arrive at a reasonable solution to ensure effective supply chain cyber risk management practices and standards are being chosen to protect public interest when using PDE.

This ORCWG effort may not achieve that objective and I need to reconsider my future level of effort.

[tobie]

Yes, I believe you might want to get involved with the ESOs directly, though I'm not sure how you would proceed as a non-EU entity.

[rjb4standards]

I agree Tobie. This is clearly not the initiative that will achieve what I'm hoping to achieve. Thanks for sharing your insights and honest opinions. I will move on.

[mrybczyn]

Back to the original subject of this issue. The ISO/IEC standard offer a double standard with "vulnerability disclosure" (for the researcher/reporter part) and "handling reports" (investigation, preparing the fix).

We do propose one single document that handles both. Because of that I propose we keep it as "vulnerability management" as the general title to avoid confusion about what we address.

[mrybczyn]

Proposition to address in #26