Coordinated Vulnerability Disclosure (CVD) Requirements Based on RED Delegated Act, CE EN 303 645, and EN 18031

Coordinated Vulnerability Disclosure (CVD) is now a critical requirement for EU cybersecurity compliance, especially under the Cyber Resilience Act (CRA) and the RED Delegated Act (EU 2022/30).
CVD requirements based on the RED Delegated Act, CE EN 303 645, and EN 18031 are essential for achieving CE marking compliance and maintaining product cybersecurity throughout the device lifecycle.

At 360Compliance, we help manufacturers implement CVD compliance frameworks that align with CE marking, RED, and CRA cybersecurity standards. Our team ensures your vulnerability disclosure processes meet all requirements set by EN 303 645 and EN 18031, supporting safe, compliant, and market-ready products.

What Are CVD Requirements?

CVD (Coordinated Vulnerability Disclosure) is a structured process that allows security researchers, users, and manufacturers to report and resolve cybersecurity vulnerabilities safely and transparently.

Under EU cybersecurity regulations, CVD is no longer optional — it’s an expected part of CE and UKCA certification for connected and digital products.

For reference, see:

• ETSI EN 303 645 Standard – Cyber Security for Consumer IoT
• ETSI EN 18031 Standard – Coordinated Vulnerability Disclosure

CVD Under the RED Delegated Act and EU Cyber Resilience Framework

The RED Delegated Act (EU 2022/30) mandates that manufacturers of connected radio equipment implement cybersecurity measures, including vulnerability management and disclosure.

Together with the Cyber Resilience Act (CRA), these frameworks require that manufacturers:

• Maintain a vulnerability handling policy.
• Provide a public reporting channel for security researchers.
• Manage vulnerabilities according to EN 18031 guidelines.
• Demonstrate compliance during CE marking and market surveillance.

👉 Learn more about the Radio Equipment Directive (2014/53/EU) and RED Delegated Act requirements.

Why CVD Requirements Matter

Implementing a CVD process helps manufacturers:

• Detect and fix vulnerabilities early.
• Prevent cyberattacks and data breaches.
• Demonstrate compliance with EN 303 645, EN 18031, and CRA.
• Protect customer trust and product reputation.
• Avoid costly enforcement actions and delays in CE approval.

Without a structured CVD framework, unresolved vulnerabilities can lead to:

• Market access delays under EU cybersecurity rules.
• CRA or RED-related penalties.
• Reputational damage and loss of consumer confidence.

Explore more on our Cyber Resilience Act compliance services.

Who Must Implement CVD Policies?

CVD requirements apply to all manufacturers of networked or connected devices, including:

• IoT devices – smart home, industrial, medical, and wearables
• ICT and connected equipment
• Radio devices under the CE RED Delegated Act (EU 2022/30)
• Software and cloud-connected products

If your product connects to a network or processes data, CVD compliance is mandatory for EU market access.

Key Elements of a Strong CVD Policy

A compliant CVD framework typically includes:

• Defined Reporting Channels – Clear, accessible ways for researchers to submit reports.
• Disclosure Management – Documented procedures for evaluating and addressing issues.
• Communication Protocols – Coordinated notifications to reporters and affected users.
• Traceability Records – Logs of assessment, mitigation, and closure.
• Lifecycle Integration – CVD embedded across the device lifecycle.

Our experts can help design and validate your framework as part of your CE cybersecurity testing program

Steps to Achieve CVD Compliance

1. Assess Your Current Processes – Identify gaps in vulnerability handling.
2. Develop a Formal CVD Policy – Align with EN 303 645, EN 18031, and the RED Delegated Act.
3. Implement Reporting Channels – Secure, traceable mechanisms for disclosures.
4. Train Internal Teams – Ensure engineering/compliance staff know the workflows.
5. Audit and Improve Regularly – Maintain alignment with CE and CRA.

For professional support, see our Cybersecurity Testing & Certification Services

Consequences of Non-Compliance

Failure to meet CVD requirements may result in:

• Market access denial under EU RED or CRA.
• Regulatory fines or penalties.
• Product recalls or halted shipments.
• Damaged trust and long-term brand harm.

FAQs About CVD Requirements

Is CVD mandatory under EU law?
Yes. Under the Cyber Resilience Act (CRA) and RED Delegated Act, manufacturers must maintain a vulnerability disclosure process aligned with EN 18031.

Are EN 303 645 and EN 18031 related?
Yes. EN 303 645 defines IoT cybersecurity requirements, while EN 18031 specifies how vulnerabilities should be reported and handled.

Do small companies need a CVD policy?
Yes — the rules apply to all manufacturers placing connected products on the EU market.

Why Choose 360Compliance

At 360Compliance, we simplify CVD compliance by combining technical expertise with regulatory insight.
We help you design, implement, and document CVD frameworks that align with the RED Delegated Act, EN 303 645, EN 18031, and the Cyber Resilience Act.

Our Services Include:

• CVD Policy Development – Tailored disclosure frameworks for your products.
• Cybersecurity Testing & Evaluation – Vulnerability and risk testing before market launch.
• Regulatory Alignment – CRA, CE, RED, and UKCA compliance support.
• Training & Documentation – Equipping teams to manage and resolve disclosures effectively.

👉 Contact 360Compliance to establish a complete CVD compliance framework and strengthen your product’s cybersecurity today.