With EU CRA Article 14 reporting in force since 11 September 2026, many teams are asking how to show a customer or auditor that their disclosure process actually runs. CISA already answered a version of this for US agencies. BOD 20-01 requires agencies to report VDP metrics quarterly through CyberScope, and the list works as a template for anyone.
What's affected
Any team with a published VDP. BOD 20-01 binds federal agencies only, but its ten metrics are a practical checklist:
| Metric | How to compute it |
|---|---|
| Reports received | Count of tickets in the period |
| Valid reported vulnerabilities | In scope and not false positive |
| Open and valid | Valid, not yet fixed or mitigated |
| Median age of open and valid | Days since receipt, median |
| Open and valid older than 90 days | Count |
| All reports older than 90 days, by priority | Count per priority |
| Median age of those reports older than 90 days | Days |
| Median time to validate | Receipt to validation decision |
| Median time to remediate or mitigate | Receipt to fix, valid reports only |
| Median time to initially respond | Receipt to first human reply |
The directive lists the validate, remediate and respond metrics as medians, which is a good habit. Averages are skewed by one stale report.
What to do now
- Create a sheet or ticket view with these columns: received at, first response at, validated at, priority, fixed at, status.
- Compute the medians monthly. A spreadsheet is enough:
Median time to respond (days) = MEDIAN of (first_response_at minus received_at)
Open older than 90 days = COUNTIFS(status,"open", age_days,">90")
- Compare time to respond with the promise in your VDP. If the median is above your published number, change the page or the staffing.
- Review the 90 day bucket every quarter. Reports sitting there are the ones a researcher may decide to publish.
- Share a short summary with customers who ask: reports received, valid reports, median response, oldest open item.
Try the walkthrough below to see how findings and their ages show up in a vulnerability management view.
Click through it at your own pace, or open it full screen.
Quick check
Why does BOD 20-01 use medians for time to validate and remediate?
A median is not distorted by a few very old reports, so it reflects typical performance. Count the old ones separately, as the 90 day metrics do.
