Key Facts
- Regulator
- ISO/IEC JTC 1/SC 27 (Information security, cybersecurity and privacy protection), published by ISO and IEC
- Latest version
- ISO/IEC 30111:2019, Edition 2 (Information technology — Security techniques — Vulnerability handling processes); confirmed in 2025 and still current, with a revision under way
- Effective
- 1 October 2019
- Official text
- www.iso.org ↗
What is ISO/IEC 30111?
ISO/IEC 30111, often searched as ISO 30111, is the international standard on vulnerability handling processes: how a vendor deals with reports of potential vulnerabilities in its product or service, through to a fix. ISO and IEC publish it through committee ISO/IEC JTC 1/SC 27. The 2019 edition applies to vendors involved in handling vulnerabilities.
The current version is ISO/IEC 30111:2019, Edition 2, Information technology — Security techniques — Vulnerability handling processes. ISO confirmed it in 2025 and it remains current, with a revision under way. At 13 pages it is short, and it replaced ISO/IEC 30111:2013, which has been withdrawn.
ISO has listed the 2019 edition as "to be revised" (stage 90.92) since September 2025. Its replacement, ISO/IEC WD 30111.2 (Edition 3), is titled Cybersecurity — Vulnerability handling and disclosure processes. It comes from the same committee and reached stage 20.60, close of comment period, on 1 August 2026.
We have no confirmed publication date for the third edition. Until it appears, ISO/IEC 30111:2019 is the edition to cite.
Why it matters
A researcher emails your support address to say your product exposes customer data. Nobody is sure whose job it is. The message sits unanswered for a week.
ISO/IEC 30111 describes what should happen between that email arriving and a fix reaching customers. It gives requirements and recommendations for processing and remediating reported potential vulnerabilities in a product or service.
A vulnerability report with no owner is just an email.
The pressure to have a process can be legal as well as contractual. UK rules for consumer connectable products require manufacturers to publish a reporting contact and say when a reporter will hear back (see the UK position below). Those rules do not cite ISO/IEC 30111, but they ask for the behaviour it describes.
Who it applies to
ISO/IEC 30111:2019 is written for vendors. Its scope says it applies to vendors involved in handling vulnerabilities, which points to organisations that build and support a product or service where outside parties may report flaws: software, SaaS and device makers among them.
The draft third edition is wider. Its scope reads "anyone involved in handling vulnerabilities". That is a working draft, so the 2019 wording governs for now.
Obligation. ISO's page does not state one, and no UK regulation we checked names the standard. Treat ISO/IEC 30111 as voluntary: something you adopt, or something a customer or contract asks you to demonstrate. Read the exact wording of any questionnaire or tender that cites it.
ISO 27001 is a management system standard for your whole information security programme. Its nearest control, A.8.8 Management of technical vulnerabilities, covers weaknesses in the systems you use. ISO/IEC 30111 is narrower and points the other way: it covers reports of vulnerabilities in what you supply.
The UK position
A UK firm meets ISO/IEC 30111 by choice or by contract, not by statute. No UK law names it.
The nearest legal hook is the Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023 (SI 2023/1007, Schedule 1). They require manufacturers of UK consumer connectable products to publish at least one point of contact for reporting security issues. They must also publish when the reporter will receive an acknowledgement, and status updates until the issue is resolved.
The Regulations do not cite the standard. The reporting and handling behaviour they ask for is what ISO/IEC 30111 and ISO/IEC 29147 describe. If your product is not a consumer connectable product, the standard reaches you only through your own choice or a contract.
Key requirements
ISO/IEC 30111 vulnerability handling has two layers: the groundwork a vendor puts in place, then the process each report follows. The headings below come from the standard's contents page. The full text is paywalled and sold through ISO's official page for ISO/IEC 30111, so read this as a map of what it covers, not a summary of each requirement.
The groundwork (clause 6, policy and organisational framework):
- Leadership and policy. Management commitment, a vulnerability handling policy, and named roles, responsibilities and authorities.
- A response team. A vendor CSIRT or PSIRT (product security incident response team), with a mission, defined duties and the staff skills to match.
- The wider business. Set duties for the product business division, customer support and public relations, plus access to legal advice.
The handling process (clause 7) runs in six phases:
- Preparation. Getting ready before any report arrives.
- Receipt. Taking in a report, whether it comes from inside or outside the organisation.
- Verification. Checking whether the reported issue is real.
- Remediation development. Building the fix or other remediation.
- Release. Getting the remediation to affected users.
- Post-release. Following up once the remediation is out.
Alongside the phases, the standard covers monitoring the process itself, keeping vulnerability details confidential, and supply chain considerations.
A process nobody can show you is a process you do not have.
How it works with ISO/IEC 29147
ISO/IEC 30111 is written to be used with ISO/IEC 29147, the vulnerability disclosure standard. The two meet at two points:
- Coming in. ISO/IEC 29147 covers how a vendor receives reports of potential vulnerabilities from outside.
- Going out. ISO/IEC 29147 covers how the vendor gives remediation information to affected users.
The handling in between is ISO/IEC 30111's job.
What the revision changes
Based on what ISO publishes about the draft, the revision changes the title and the scope:
- Title. The draft is called Cybersecurity — Vulnerability handling and disclosure processes. Adding "disclosure" suggests the subject of ISO/IEC 29147 is being brought under the same title.
- Scope. It widens from vendors to anyone involved in handling vulnerabilities.
- Status. The draft will replace the 2019 edition once published. The stage dates on ISO's page may change.
Frequently asked questions
ISO/IEC 30111:2019, Edition 2, is the current version. ISO's systematic review confirmed it in March 2025, then marked it "to be revised" in September 2025. The working draft that will replace it reached close of comment period in August 2026. ISO/IEC 30111:2019 remains the edition to cite until a third edition is published.
A PSIRT is a product security incident response team: the group that handles vulnerability reports about a vendor's products. ISO/IEC 30111 gives it a clause of its own, covering its mission, its duties and the skills its staff need, and a vendor CSIRT can fill the role. It works alongside the product business division, customer support and public relations, which the standard also gives duties.
ISO/IEC 29147 is about disclosure: taking reports in from outside and publishing remediation information. ISO/IEC 30111 is about handling: what the vendor does internally with each report. ISO describes the goal of ISO/IEC 29147 as reducing the risk of vulnerabilities being exploited, and stresses coordinated disclosure when several vendors are affected. ISO/IEC 29147:2018 is the current disclosure edition.
Yes. The introduction to ISO/IEC 30111 names three audiences: developers and vendors responding to vulnerability reports, evaluators assessing a vendor's handling process, and users setting procurement requirements for developers, vendors and integrators. A buyer can therefore write ISO/IEC 30111 into a contract or security questionnaire and ask the supplier to show its handling process against it.
ISO/IEC 30111 is not a management system standard, and ISO itself does not certify organisations. Because the standard names evaluators among its audiences, an independent assessor can review a vendor's handling process against it. Without a certificate, a vendor shows conformance through evidence: its vulnerability handling policy, the roles behind it and records of reports handled.