SBOM and vulnerability handling pack
The documents you need before an incident, not after one.
€79 · DOCX, XLSX, Markdown and PDF
One organisation · every product you make · every colleague · no renewal
What is inside
- Coordinated vulnerability disclosure policy — publishable, with the contact address and response commitments Annex VII expects evidence of.
- Article 14 report drafts — pre-written 24-hour early warning, 72-hour notification and final report, with the fields that need filling marked and the rest already said properly. A 24-hour clock is not the time to be drafting prose.
- Severity triage rubric (XLSX) — decide in advance what counts as a severe incident and what counts as actively exploited, so the 2am judgement is a lookup rather than an argument.
- SBOM policy — format, depth, generation point, storage, retention and the review cadence, written as a process description that fits Annex VII section 2.
- Security advisory template — for the user-notification duty that sits alongside the authority report.
- Secure update mechanism description — the Annex I Part II requirement, described in the terms the regulation uses.
- Incident decision log — including the record of decisions not to report, with reasoning. Worth more than any other single page if you are ever asked.
Who it is for
Every manufacturer of a product with digital elements, because Article 14 reporting has applied since ${ART14}. Most urgent for small teams with no security operations function.
What it does not do
Licence
One organisation, unlimited internal use, unlimited products, perpetual, adaptable. No resale, redistribution or publication; no use to produce documentation as a service for third parties without a consultancy licence. Full terms →
What you actually download
One ZIP, 102 KB. Every file is listed below — no surprises, nothing missing.
| File | What it is |
|---|---|
| START-HERE.txt | The working order, the licence, and what this pack does not do. |
| Vulnerability-Handling-Pack.docx | 11 pages. A publishable coordinated disclosure policy, a security advisory template, all three Article 14 report drafts, and a user notification. |
| Severity-Triage-and-Incident-Log.xlsx | Four sheets: the triage rubric, a reporting-clock calculator that computes your 24-hour, 72-hour and final deadlines, and the incident decision log. |
| SBOM-Policy.md | A complete SBOM policy, written to satisfy Annex I Part II(1) and to be referenced from your technical file. |
| Vulnerability-Handling-Pack.pdf | Read-only copy. |
How you would get it
When this goes on sale: an immediate download link, with a second copy by email. No account to create, no login, nothing to install. Twelve months of updates included.
Ask about this pack
This pack is finished — written, laid out and checked page by page. What is not open yet is the checkout, so for now you buy by talking to a person rather than clicking a button. Tell us what you need and you will hear back within two working days, from someone who can tell you exactly what is in it.
No account, no card, no obligation. If you would rather just email, contact@compliantbook.com reaches the same person.