Skip to main content

Acknowledgment SLAs

CVD Portal tracks how fast your team acknowledges new vulnerability reports and how fast it resolves them.

Confirmation to the researcher​

When a researcher sends a report through the portal and gives an email address, CVD Portal sends a confirmation email with a tracking link. This email is automatic. It is not the acknowledgment.

Acknowledge a report​

  1. Open the report in Submissions.
  2. Click Acknowledge report.

The status changes from NEW to ACKNOWLEDGED and CVD Portal records the time. If the report has a contact email, CVD Portal sends an acknowledgment email to the researcher. You can acknowledge a report only once, and only while its status is NEW.

Acknowledgment target​

The default acknowledgment target is 48 hours. On the Reporting plan or higher, you can change the acknowledgment target (1 to 720 hours) and the triage target in Settings → General. The dashboard shows the number of reports that are past your acknowledgment target. The Submissions list uses a fixed 48-hour window for its overdue count.

Resolution SLA per severity​

On the Enterprise plan, you can set a resolution window in hours for each severity in Settings → General. The window starts at the acknowledgment time, or at the report time if there is no acknowledgment. Every hour, a scheduled job finds reports past their window. It then sends a Telegram alert to the CVD Portal operations team and sends the sla.breached event to your webhooks for that event. See Configuring Webhooks.

Reporting​

The Analytics page shows the mean time to acknowledge (MTTA). See Compliance Analytics & Reporting.