SBOM and vulnerability handling pack

The documents you need before an incident, not after one.

€79  ·  DOCX, Markdown and XLSX

Releasing soon — join the list below for launch pricing

What is inside

• Coordinated vulnerability disclosure policy — publishable, with the contact address and response commitments Annex VII expects evidence of.
• Article 14 report drafts — pre-written 24-hour early warning, 72-hour notification and final report, with the fields that need filling marked and the rest already said properly. A 24-hour clock is not the time to be drafting prose.
• Severity triage rubric (XLSX) — decide in advance what counts as a severe incident and what counts as actively exploited, so the 2am judgement is a lookup rather than an argument.
• SBOM policy — format, depth, generation point, storage, retention and the review cadence, written as a process description that fits Annex VII section 2.
• Security advisory template — for the user-notification duty that sits alongside the authority report.
• Secure update mechanism description — the Annex I Part II requirement, described in the terms the regulation uses.
• Incident decision log — including the record of decisions not to report, with reasoning. Worth more than any other single page if you are ever asked.

Who it is for

Every manufacturer of a product with digital elements, because Article 14 reporting has applied since 11 September 2026. Most urgent for small teams with no security operations function.

What it does not do

Licence

One organisation, unlimited internal use, unlimited products, perpetual, adaptable. No resale, redistribution or publication; no use to produce documentation as a service for third parties without a consultancy licence. Full terms →

Format and delivery

DOCX, Markdown and XLSX. Delivered as an immediate download link after payment, with a second copy by email. No account to create, no login, nothing to install. Updates for twelve months are included and are sent to the email address used at purchase.