NIS2 / managed vulnerability disclosure
NIS2 compliance.
Disclosure with
a clear owner.
Give incoming vulnerability reports a working process. Hackrate managed VDP connects structured intake, human validation, reporter communication, and a traceable engineering handoff to your NIS2 vulnerability handling programme.
From finding
to accountable action.
- 01Receive & clarify
Structured external vulnerability reports
- 02Validate & prioritize
Technical evidence and business context
- 03Remediate & review
Named owners and documented outcomes
START WITH YOUR ORGANIZATION
What is NIS2?
A wider security responsibility.
The NIS2 Directive strengthens cybersecurity across critical sectors in the EU. It addresses risk management, governance, and significant incident reporting for covered essential and important entities. A managed disclosure process can connect external vulnerability reports to that wider security programme.
Scope generally includes medium and large entities in specified sectors, with exceptions that can bring smaller entities into scope. Energy, transport, health, digital infrastructure, ICT service management, and certain manufacturing activities are among the covered areas. Sector, entity type, size, jurisdiction, and applicable exceptions all matter.
Scope overview: European Commission: NIS2 Directive.
Start from the rules that apply to you.
The EU transposition deadline was 17 October 2024. Confirm current national law, your competent authority, and relevant sector rules before setting your program. Commission proposals to amend NIS2 are separate from the rules currently in force.
For financial entities covered by DORA, assess the sector-specific rules for the corresponding obligations. Explore DORA and managed VDP, and read the Commission guidance on NIS2 Article 4.
HACKRATE SERVICES
Make vulnerability reporting
a managed process.
Connect the reporting route to human review, the finder conversation, and the team responsible for the next action. Define each part of the service around your internal process.
Structured disclosure intake
Give external reporters a clear destination for security findings. Capture the affected asset, technical description, reproduction information, and supporting evidence through the agreed disclosure channel.
A published reporting route connected to people who can review what arrives.
Human triage and context
Hackrate reviews relevance, reproduction details, duplicates, and demonstrated impact within the agreed service. Your team adds business context so the technical finding reaches a useful priority decision.
A reviewed finding with evidence, limitations, and open questions made clear.
Reporter communication
Keep clarification requests and progress updates connected to the report. An agreed communication process helps your security and engineering teams work with the finder while keeping sensitive details controlled.
Consistent communication with a route for urgent information and internal decisions.
Remediation handoff and records
Route validated findings to the responsible owner with the information needed to act. Connect decisions and remediation updates to the report, with verification and disclosure coordination where included.
A reviewable record of the finding, ownership, response, and agreed follow-through.
Managed VDP receives disclosures under your agreed policy. If you also want to invite active research, define the testing permissions, scope, and rewards separately through a managed bug bounty programme.
CONNECT REQUIREMENTS TO DAILY WORK
Where Hackrate supports
your NIS2 implementation.
These are practical service contributions to a wider program. Use your applicable requirements to define the engagement and the evidence your team needs.
Vulnerability handling
and disclosure
NIS2 includes vulnerability handling and disclosure within security for system acquisition, development, and maintenance.
Put it into operation
Publish a clear reporting route, agree how incoming reports are reviewed, and connect validated findings to engineering through managed VDP.
Assessing security
measure effectiveness
NIS2 calls for policies and procedures that assess the effectiveness of cybersecurity risk-management measures.
Bring operational evidence
Retain assessment and handling records that help your team review how disclosures were received, routed, and acted on. Your organisation defines the wider effectiveness assessment.
Incident and supplier
security processes
Incident handling and supply chain security are also part of the risk-management framework.
Connect the handoff
Route relevant evidence to incident owners and coordinate findings involving suppliers. Testing third-party systems still needs explicit authorization.
Requirement references: Directive (EU) 2022/2555, Article 21. The service mapping above describes Hackrate’s proposed contribution.
Connect disclosure to the wider handling process.
Implementing Regulation (EU) 2024/2690 sets detailed requirements for specified digital infrastructure, ICT service management, digital provider, and trust service entities. Its Annex addresses vulnerability handling and disclosure in point 6.10, including links to patch, change, risk, and incident management. Separate security testing requirements appear in point 6.5. ENISA provides non-binding implementation guidance, including examples of evidence. Confirm whether your entity falls within this regulation before using its detailed requirements to scope your program.
Read ENISA’s technical guidanceA PROCESS YOUR TEAM CAN OPERATE
Receive. Validate.
Coordinate. Follow through.
Keep external report handling connected to engineering and risk decisions. Define urgent escalation separately so incident assessment can proceed while validation continues.
Publish and receive
Define the reporting channel, policy, affected assets, and expected communication. Receive disclosures with the technical information needed for assessment and a clear internal destination.
Validate and clarify
Review evidence, relevance, reproducibility, and duplicates. Request missing context from the finder. Any additional testing or reproduction needs the appropriate authorisation and access.
Route and prioritise
Send the reviewed finding to the responsible owner. Your team adds service impact and risk context. Escalate possible incident information promptly while assessment continues.
Act and follow through
Your engineers implement the chosen fix or mitigation. Keep reporter communication, decisions, and progress connected, and record verification or coordinated disclosure where included.
MAKE THE WORK REVIEWABLE
Useful evidence
has context.
A vulnerability count alone says little about your security process. Agree deliverables that let engineering, risk owners, and reviewers understand the assessment and what happened next.
Set the reporting format, access, retention needs, and included verification during scoping. Your organization determines which records belong in its formal compliance documentation.
Scope and limitations
Reporting scope, affected assets, authorised validation, and constraints that affect the assessment. Make the evidence and its limitations clear to anyone reviewing the finding.
Validated technical detail
Reproduction steps, affected assets, supporting evidence, and demonstrated impact. Separate observed behavior from assumptions that need investigation.
Ownership and decisions
The responsible team, chosen remediation or mitigation, outstanding questions, and escalation history. Keep your internal risk decisions attached to the work.
Verification and next steps
Where retesting is included, record the result and any remaining limitations. Keep open issues visible and use recurring findings to improve the handling process.
KEEP THE INCIDENT ROUTE READY
A disclosure channel.
An incident reporting obligation.
NIS2 Article 23 concerns significant incidents. An incoming vulnerability report is not automatically such an incident. Your designated team assesses the facts and applicable criteria, then uses the required CSIRT or competent authority channel.
Without undue delay, within 24 hours of becoming aware of a significant incident.
Without undue delay, within 72 hours of awareness. For significant incidents affecting trust services, trust service providers have a 24-hour notification limit.
No later than one month after the incident notification. If the incident is ongoing, submit a progress report then and a final report within one month of handling it.
Intermediate reports may also be requested. Reference: Article 23 of the NIS2 Directive. Confirm the applicable national procedure and sector-specific significance criteria.
Escalate evidence as soon as it matters.
Agree the contacts and backup route for possible incident information before launch. Hackrate’s report intake is not the statutory notification channel and does not imply round-the-clock incident response or automatic authority submissions. Do not wait for routine triage, a bounty decision, or a CVE before assessing a reporting trigger.
CLEAR SUPPORT. CLEAR OWNERSHIP.
Technical expertise.
Your security governance.
Define the service responsibilities and internal decisions together. Your management, security, engineering, and compliance teams need a shared understanding of the handoff.
Hackrate’s agreed contribution
- Provide structured intake and review disclosures received through the agreed channel.
- Review incoming reports and coordinate researcher communication within the selected service.
- Provide technical findings, evidence, and an actionable handoff.
- Support agreed verification and reporting for your internal review.
Your organization’s ownership
- Confirm scope, national obligations, and any required registration or audit.
- Approve risk-management measures and oversee implementation.
- Own remediation, risk acceptance, incident decisions, and authority notifications.
- Maintain the wider program, including continuity, access, training, and supplier controls.
Governance and wider measures: NIS2 Articles 20 and 21. The services on this page do not constitute a statutory NIS2 audit or a compliance certificate.
YOUR QUESTIONS, ANSWERED
NIS2 & managed
VDP FAQs.
Understand the disclosure service, regulatory context, and responsibilities at each handoff.
Talk through your scopeHow does managed VDP support NIS2 compliance work?
Hackrate managed VDP supports external vulnerability intake, human validation, reporter communication, and a documented handoff to your team. These activities can support the vulnerability handling and disclosure part of your NIS2 programme. Agree the scope, escalation contacts, records, and any verification work while keeping internal risk and compliance decisions with your organisation.
Does NIS2 require a public bug bounty programme?
NIS2 includes vulnerability handling and disclosure in its risk-management framework. It does not impose a general requirement to buy a public bug bounty programme. A managed VDP provides disclosure intake and agreed handling. Any invitation to test, researcher access, or rewards requires separate programme terms and authorisation.
Is a managed VDP enough for NIS2 compliance?
Managed VDP supports a defined part of the programme. NIS2 also addresses governance, incident handling, continuity, supply chain security, and other risk-management measures. Your organisation must determine its applicable national requirements and operate the wider programme alongside the disclosure service.
Which organisations should assess NIS2 applicability?
Scope depends on sector, entity type, size, jurisdiction, and statutory exceptions. The directive generally covers medium and large entities in specified sectors, with some smaller entities also covered. Confirm current national law and any sector-specific EU rules. For relevant financial entities, DORA takes precedence for the corresponding requirements.
Does every vulnerability report require an authority notification?
No. A vulnerability report is not automatically a significant incident under NIS2. Your designated team assesses the facts and applicable significance criteria. Evidence suggesting an incident should reach that team promptly. The assessment and any statutory reporting clock must not wait for routine triage, a CVE, or a disclosure decision.
What happens to incomplete or duplicate reports?
Within the agreed service, Hackrate reviews what the submission demonstrates, requests clarification where useful, and identifies duplicates or reports outside the defined scope. Your team receives the relevant technical context and outstanding questions. Receipt, validation, remediation, and closure are different stages and should remain clear in the record.
Can the disclosure records support our audit or internal review?
Agree the report format and records your reviewers need, including scope, evidence, decisions, ownership, communication, and remediation progress. Your organisation determines how these records fit its formal documentation and assessor requirements. Managed VDP is not a statutory audit or a compliance certificate.
How do NIS2 and DORA differ for vulnerability disclosure?
NIS2 explicitly includes vulnerability handling and disclosure among its risk-management measures. DORA provides sector-specific requirements for covered financial entities, including vulnerability management and responsible disclosure in its technical rules. Assess which framework applies to your entity and the relevant obligations before defining the service contribution.
OFFICIAL REFERENCES
Read the source.
Define your scope.
Reviewed 25 October 2026
- Directive (EU) 2022/2555 Scope, governance, risk-management measures, and incident reporting.
- European Commission: NIS2 overview EU policy background, transposition, and implementation resources.
- Implementing Regulation (EU) 2024/2690 Detailed requirements and incident significance criteria for specified entities.
- ENISA: technical implementation guidance Non-binding implementation advice and examples of evidence for the implementing regulation.
Use the official texts and current national guidance for your applicability assessment. Agree Hackrate’s service contribution as part of your wider implementation plan.
TURN PRIORITIES INTO A WORKING PROCESS
Start with your systems.
Build the next step.
Bring your critical services, existing reporting route, and internal owners. Shape a managed disclosure process that supports your NIS2 vulnerability handling work.
Plan Your NIS2 Disclosure
Hackrate
Our platform helps companies to identify software vulnerabilities in a cost-efficient way. It provides a secure and centralized view of ethical hacking projects for your company.
US Patent Applied for HackGATE #63/645,845
Products
From the Blog
-
Hackrate Ranked 1st in Hungary and 22nd Globally at Hack The Box’s Global Cyber Skills Benchmark 2026
May 29 • 13 min read
-
Press release: Hackrate becomes Hungary’s first CVE Numbering Authority
Jan 13 • 5 min read ★
-
Let 2026 be the year bug bounty becomes part of how you build and operate
Jan 05 • 4 min read
Numbering Authority