# GOV-10 Vulnerability disclosure

Domain: GOV Governance & Accountability · HI-AAF v1.3 · Public review · https://humanintel.net/standard/gov/gov-10

A coordinated vulnerability disclosure (CVD) process is published, including intake channel, acknowledgment SLA, triage and remediation timelines, and safe-harbor language.

The organization publishes a coordinated vulnerability disclosure process for its AI agents and supporting infrastructure. The process includes a public intake channel, an acknowledgment SLA, documented triage and remediation timelines, and safe-harbor language for good-faith researchers. CVD findings flow into the change management process under GOV-05.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for GOV-10: CVD process is published and accessible; intake channel is monitored; at least one disclosure has been processed through the pipeline or the process has been tested end-to-end; findings are tracked through remediation.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- CVD process is published and accessible.
- Intake channel is monitored.
- At least one disclosure has been processed through the pipeline or the process has been tested end-to-end.
- Findings are tracked through remediation.

## Framework mappings

- NIST AI RMF: GOVERN 6.1, GOVERN 6.2
- ISO/IEC 42001: A.3.3
- SOC 2 (TSC): CC7.4
- EU AI Act: Art. 9(9)
- Singapore: MAIGF Internal Governance

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Related

- Cites GOV-05 Change management authority: https://humanintel.net/standard/gov/gov-05

## Cite this control

Human Intelligence. HI-AAF v1.3, GOV-10 Vulnerability disclosure. Public review edition, July 2026. https://humanintel.net/standard/gov/gov-10