ISO/IEC 29147

Vulnerability Disclosure: PURL/CPE correlation, hash verification, coordinated disclosure.


Short name	ISO 29147
Region	International
Country or scope	International
Sector	General
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers ISO 29147

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 7 controls from Safeguard's control catalog for ISO 29147.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for ISO 29147 and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`ISO29147-CONTACT` Vulnerability Report Contact Point	The vendor must publish a capability and point of contact for receiving vulnerability reports, so the SBOM creator must include reachable contact information (ISO/IEC 29147, receiving vulnerability reports)	Scan
`ISO29147-PRODID` Affected Product Identification	Advisories and coordination require unambiguous identification of affected products, satisfied by PURL or CPE identifiers on components (ISO/IEC 29147, advisory content on affected products)	Scan
`ISO29147-VERSIONS` Affected Version Enumeration	Vulnerability advisories must state which versions are affected, which requires version information for every component (ISO/IEC 29147, advisory content on affected versions)	Scan
`ISO29147-VERSPEC` Specific Version Designators	Correlating reports to affected releases is only possible with specific version designators, not wildcards or ranges (ISO/IEC 29147, product and version identification)	Scan
`ISO29147-UID` Identifier Correlation	Coordinated disclosure across parties depends on shared unique identifiers such as package URLs for the software in question (ISO/IEC 29147, coordination and identifiers)	Scan
`ISO29147-DOC` Traceable Disclosure Documentation	Disclosure processes require dated, identifiable documentation of the software composition to assess report applicability (ISO/IEC 29147, documentation of the disclosure process)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`ISO29147-6.1`	Establish a Vulnerability Intake Process
`ISO29147-6.2`	Triage and Assess Reported Vulnerabilities
`ISO29147-6.3`	Communicate Remediation Plans to Reporters
`ISO29147-6.4`	Remediate Vulnerabilities Within Defined SLAs
`ISO29147-7.1`	Coordinate Public Vulnerability Disclosure
`ISO29147-7.2`	Publish Security Advisories for Resolved Vulnerabilities
`ISO29147-8.1`	Measure and Improve the Disclosure Process

Policy templates

Written for ISO 29147:

Vulnerability Disclosure Policy (ISO/IEC 29147)
Internal Vulnerability Handling Process (ISO/IEC 29147)

And 22 from the standard set, adapted to ISO 29147.