A tracking record for inbound reports needs about a dozen fields: who reported it, what and where it affects, when each step happened, who owns it, the severity and status, and where the fix and advisory live. Keep it small enough that people fill it in.
Why a record at all
Email threads lose state. A case record makes you answer simple questions: how many reports did we get, how long until we replied, which are still open. CISA's directive lists metrics agencies report, including the number of reports, the number determined valid, the median age of open valid reports, the number older than 90 days, median time to validate, median time to remediate, and median time to initially respond. Those need dates captured at every step, so the record has to hold them.
A practical field list
| Group | Field | Notes |
|---|---|---|
| Identity | Case ID | One per vulnerability, not per email |
| Identity | Reporter name or handle | And how they want to be credited |
| Identity | Contact method | Email, form or platform |
| Report | Received date | Start of every clock |
| Report | Affected product and version | As reported, then as confirmed |
| Report | Summary | One or two sentences, no sensitive payloads |
| Report | Weakness type | For example access control or injection |
| Triage | Status | New, acknowledged, confirmed, fixing, fixed, closed |
| Triage | Outcome | Valid, duplicate, out of scope, informational, not reproduced |
| Triage | Severity and vector | With the assumptions you made |
| Response | First reply date | Your response metric |
| Response | Owner | One named person |
| Response | Next update due | Prevents silent stalls |
| Fix | Fix reference | Pull request or release |
| Fix | Fixed in versions | Feeds the advisory |
| Disclosure | CVE ID | If assigned |
| Disclosure | Advisory link and publish date | Closes the loop |
| Disclosure | Credit and agreed publish terms | Avoids surprises |
You can drop fields that you will never read. Do not drop the received date, the first reply date and the owner.
Where to store the evidence
Keep the reproduction log and the original report in a restricted folder linked from the record, not pasted into the ticket body. If you use a general issue tracker, mark the project private and limit membership, because access control is part of handling reports safely.
Status definitions to agree on
- Acknowledged: a human replied.
- Confirmed: you reproduced the effect.
- Fixing: a change is in progress with an owner.
- Fixed: the fix is released, not just merged.
- Closed: the reporter was told the outcome.
The BOD 20-01 targets treat acknowledgment, initial assessment and resolution as the three milestones, each with a recommended time limit. Build those three into your record and you will have the timeline data you need.
Review rhythm
Once a week, the case reviewer sorts open cases by next update due and sends any overdue updates. Once a quarter, compute the medians above and ask whether they match what your disclosure policy promises. The post on response times you can keep helps with that.
Quick check
Should the record include the exploit details?
Link to them in a restricted location instead. The record is read by more people than the proof of concept should be.
Do I need a special tool?
No. A private spreadsheet or a private tracker project works if the fields are filled in and access is limited.
Sources
Last reviewed: 19 October 2026.
