The CERT Coordination Center was created in November 1988 in Pittsburgh at DARPA's direction, in response to the Morris worm. It is hosted by the Software Engineering Institute at Carnegie Mellon University. If a vendor will not fix an issue or cannot be contacted, CERT/CC typically discloses publicly 45 days after its first contact attempt.
What CERT/CC does
Per the Wikipedia article, CERT/CC works privately with software vendors and government agencies to address vulnerabilities before a public report. It promotes a process it calls Responsible Coordinated Disclosure. Reports can come from its own research or from outside through its Vulnerability Reporting Form.
In practice, it acts as a go-between. A researcher who cannot reach a vendor, or who finds a flaw affecting many vendors, can use a coordinator.
The 45 day figure
The 45 day window applies when a vendor is unwilling or unable to respond. It is a default, not a guarantee, and the article says it is typical, not fixed.
Other programmes use different clocks. Google's Project Zero gives vendors 90 days after notification, and shares details after that period or sooner if a fix ships. The Wikipedia page on responsible disclosure also notes that timeframes across the industry vary from a few days to several months depending on impact and how long a fix takes.
Why the clock exists
Without a deadline, a vendor has little reason to hurry, and users stay exposed to a flaw that insiders know about. With a very short deadline, defenders have no time to ship a fix. A fixed window is a compromise between those two harms.
What to do if you maintain software
- Publish a security contact and a reporting process.
- Decide your own response times and write them down.
- Acknowledge reports quickly, even if the fix will take time.
- Tell reporters when you plan to publish, so there are no surprises.
If you receive a report from a coordinator, answer it. Silence is what triggers the public clock.
Disclosure clocks in practice
A published deadline is only useful if both sides understand it. Researchers should state their timeline in the first message. Vendors should reply with a named contact and an expected fix date, even a rough one. If the date will slip, say so before the deadline, not after. Coordinators like CERT/CC can help when a vendor is silent or when many vendors share one flaw. For your own team, keep a simple tracker with the report date, acknowledgement date, fix date and public date. It makes timelines easy to explain and easy to improve.
Quick check
What led to the creation of CERT/CC?
The Morris worm incident in 1988.
How long is the typical CERT/CC window when a vendor is unresponsive?
45 days after the first contact attempt.
Safeguard offers zero-day discovery and dependency scanning, and you can run a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
