Artifact GuideUKVulnerability Disclosure Workflow

UK PSTI Product Security Vulnerability Disclosure Workflow

Vulnerability Disclosure Workflow decisions under UK PSTI Product Security should be written in operational language: who is in scope, what must happen, what evidence proves it, and when escalation is needed.

Use this guide to turn official requirements into scope, evidence, owner, and review decisions. This guidance is practical, source-linked, and should be validated against current legal and policy requirements before implementation.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

May 9, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated May 9, 2026

Overview

This page helps you determine which UK PSTI Product Security duties apply, who owns each action, required evidence, and the review path for escalation decisions.

Section 1

How should a Vulnerability Disclosure Workflow run under UK PSTI Product Security?

Treat the workflow as an intake and response process: receive the security report, record the product and reporter details, confirm the report can be acted on, track the acknowledgement and status-update timings promised to the reporter, assess whether the issue is in scope, and escalate any compliance failure through the business and OPSS notification process when needed.

Log the report, product, reporter contact details, source quote, and the date it was received.
Acknowledge receipt using the timescale published for the product and record the next status-update date.
Check whether the product is in scope, whether the issue affects a duty in Chapter 2 of the PSTI Act, and whether the report needs legal, security, or product-owner review.
Assign an owner for triage, remediation, customer messaging, and any OPSS notification required for a compliance failure.
Record the decision, the action taken, the evidence location, and any follow-up review date.

Sources for this answer

Consumer connectable product security regulations

Supports the PSTI vulnerability-disclosure workflow requirement to publish reporting information and expected acknowledgement and status-update timescales.

The UK Product Security and Telecommunications Infrastructure (Product Security) regime

Workflow support for Vulnerability Disclosure Workflow.

Regulations: consumer connectable product security

GOV.UK guidance for manufacturers, importers, and distributors on PSTI product security compliance.

Section 2

What fields should the Vulnerability Disclosure Workflow template capture?

A useful template captures the intake details, the promised acknowledgement and status-update timings, the scope decision, the remediation owner, any escalation path, and the evidence needed to show that the report was handled in line with the published process.

Report ID, reporter contact, product name or model, receipt date, and source quote.
Expected acknowledgement time, next status-update date, and final closure date.
Scope decision, in-scope or out-of-scope reason, and the chapter 2 duty affected.
Assigned owner, escalation contact, remediation action, customer messaging note, and OPSS notification record if a compliance failure is identified.
Evidence link, approval note, exception note, and review cadence.

Sources for this answer

The UK Product Security and Telecommunications Infrastructure (Product Security) regime

Template field support for Vulnerability Disclosure Workflow.

Regulations: consumer connectable product security

GOV.UK guidance for manufacturers, importers, and distributors on PSTI product security compliance.

Consumer connectable product security regulations

Template field support for Vulnerability Disclosure Workflow.

Section 3

How should teams review and improve the Vulnerability Disclosure Workflow?

Review the workflow after firmware changes, supplier changes, product bundling changes, UK market placement changes, vulnerability reports, OPSS notices, or support-period updates.

Track recurring exception categories and update intake questions.
Remove fields that never affect the decision.
Add fields when reviews show missing source evidence or unclear ownership.
Confirm generated markdown and page content include the same visible source-linked guidance.

Sources for this answer

Consumer connectable product security regulations

Supports the PSTI vulnerability-disclosure workflow requirement to publish reporting information and expected acknowledgement and status-update timescales.

The UK Product Security and Telecommunications Infrastructure (Product Security) regime

Review support for Vulnerability Disclosure Workflow.

Regulations: consumer connectable product security

GOV.UK guidance for manufacturers, importers, and distributors on PSTI product security compliance.

Regulation of consumer connectable product cyber security

Review support for Vulnerability Disclosure Workflow.

Recommended next step

Turn UK PSTI Product Security Vulnerability Disclosure Workflow into assigned work

Use this UK PSTI Product Security guide to turn Vulnerability Disclosure Workflow into owners, evidence requests, review checkpoints, and reusable operating records inside Sorena.

Assessment workflow

Open Assessment Autopilot for UK PSTI Product Security

Turn Vulnerability Disclosure Workflow into scoped questions, evidence fields, and review tasks.

Explore next step

Research workflow

Review UK PSTI Product Security source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step

Talk to Sorena

Discuss UK PSTI vulnerability disclosure implementation

Review scope, evidence, owners, and the next compliance actions with Sorena.

Explore next step

Primary sources

References and citations

Consumer connectable product security regulations

gov.uk

Referenced sections

Supports the PSTI vulnerability-disclosure workflow requirement to publish reporting information and expected acknowledgement and status-update timescales.