Vulnerability report handling goes wrong when nobody owns the next step. Assign six roles: intake, triager, fixer, approver, communicator and tracker. In a small team one person can hold several, as long as each role has a named person and a named backup.
Why roles matter
CISA's BOD 20-01 asks agencies to describe how reports are tracked to resolution, coordinated internally, evaluated and prioritised, communicated to reporters, and assessed for past impact. Those are tasks that need owners. Without them, reports stall in an inbox.
The six roles
Intake. Watches the reporting channel. Acknowledges receipt, checks that the report is complete, and creates the tracking entry. The OWASP guidance says front line staff who monitor general contact channels should know how to recognise a security report and who to escalate it to. The intake role can be a support lead, with a clear rule.
Triager. Reproduces the issue, decides if it is valid and in scope, and proposes a severity. Needs enough technical skill to follow a proof of concept. Usually an engineer or security lead.
Fixer. The engineering owner of the affected component. Plans and ships the fix. Should be named at triage, not discovered later.
Approver. Decides on severity disputes, risk acceptance, release timing and disclosure dates. Often an engineering manager or head of security. The approver is the person who can say yes to an out of cycle release.
Communicator. Talks to the reporter and, when needed, to customers. Keeps messages consistent and regular. The OWASP guidance recommends regular status updates even without a firm fix date, and never threatening legal action.
Tracker. Keeps the register up to date, watches the clock against your targets, and reports numbers. CISA's directive suggests setting and tracking timelines for acknowledgment, initial assessment and resolution.
A simple responsibility chart
For each stage, mark who does the work, who decides, and who is told.
- Acknowledge: intake does, triager is told.
- Reproduce and rate: triager does, approver is told.
- Dispute on severity: approver decides.
- Fix: fixer does, triager verifies.
- Customer notice: communicator does, approver decides.
- Advisory and credit: communicator does, approver decides, reporter is told.
- Review of timeliness: tracker does, approver is told.
Backups and holidays
Every role needs a named deputy. Report handling clocks keep running over weekends and holidays. Put the schedule in a shared calendar and test the handover once.
Small team versions
- Two people: one holds intake, communicator and tracker. The other holds triager and fixer. The founder or head of engineering is approver.
- One person: accept that you hold every role and write the checklist so you do not skip steps. Ask a trusted outsider to be backup for approver and communicator.
Escalation triggers
Agree when to wake the approver at once:
- Evidence of active exploitation.
- Exposure of customer data.
- A reporter who sets a short deadline.
- Press or social media interest.
Review after each case
After closing a report, spend ten minutes on what slowed it down. Update the chart. Look at the OWASP and CISA guidance again each year, since your size and risks change.
Quick check
Who should talk to the reporter?
One named person, consistently. Handoffs between people confuse reporters and slow trust.
Can the fixer also triage?
Yes, in small teams. Try to have a second person confirm severity when the issue is serious.
Sources
- CISA BOD 20-01: Develop and Publish a Vulnerability Disclosure Policy
- OWASP Vulnerability Disclosure Cheat Sheet
Last reviewed: 19 October 2026.
