No, vendors are not bound by them. They come from a CISA directive for federal agencies, which calls them recommended targets and not mandatory dates. They still make a sensible starting point: acknowledge within 3 business days, assess within 7 days, resolve within 90 days, then adjust for your size and severity.
Where the numbers come from
BOD 20-01 tells agencies to set target timelines for and track three things: acknowledgment to the reporter that the report was received, initial assessment of whether the report is valid including impact, and resolution including notice of the outcome to the reporter. CISA recommends no more than 3 business days from receipt for acknowledgment, no more than 7 days for the assessment, and no more than 90 days for resolution.
The directive adds three useful points. Timelines guide actions and priorities and are not mandatory remediation dates. Critical issues should generally be fixed much faster than low impact ones. Complex situations, including multi-party coordination, may need extra time.
Turning guidance into targets
| Step | CISA guidance | A vendor adaptation |
|---|---|---|
| Acknowledge | 3 business days | Next business day for a named reply |
| Initial assessment | 7 days | 7 days, or 3 for reports that look critical |
| Resolution | 90 days, less for critical | Tiered by severity, with an explanation if you slip |
| Outcome notice | With resolution | At closure, with the label and reason |
A tiered table might say that the highest severity cases get an emergency path, with daily internal checks, and that lower severity cases follow the 90 day pattern. Whatever you choose, write it down and make sure you can keep it.
Why 90 days shows up everywhere
A 90 day window is a familiar number in disclosure discussions. Our explainer on 90, 30 and 45 day deadlines covers where those come from. For this post, the point is simpler: a common number lowers friction between reporters and vendors, because both sides know what to expect.
When to miss a target
You will miss one eventually. The honest path is to tell the researcher before the date, explain why, and offer a new date. See your fix will miss the date.
What to publish and what to keep internal
You can publish an acknowledgment promise without promising a fix date. Researchers mostly want to know they will be heard. Keep tighter engineering targets internal, and share a calibrated version in your policy. See what to promise researchers.
Measure your own performance
Compute your median time to acknowledge, assess and resolve, and compare it with your targets each quarter. See which metrics to track.
Try it yourself
Click through it at your own pace, or open it full screen.
Watch how a newly disclosed issue moves from first sighting to action, and think about which of your three clocks would be running at each stage.
For dependency issues, Safeguard's autonomous remediation can open fix pull requests (off by default, every category on manual), which can shorten the resolve step. You can also run a free scan.
Quick check
Are the 3, 7 and 90 day targets legal requirements for my company?
They come from a directive aimed at federal agencies and are described as recommendations. Your own contracts or regulations may set other duties, so check with counsel.
Which target matters most to researchers?
The acknowledgment. It is cheap to meet and sets the tone for the rest of the case.
Sources
Last reviewed: 19 October 2026.
