Skip to main content

Team Roles & Permissions

Effective vulnerability management requires strict access control and clearly delineated responsibilities. The CVD Portal implements a robust Role-Based Access Control (RBAC) system designed to align with the Cyber Resilience Act (CRA) requirements for data minimization and secure handling of sensitive vulnerability information. By assigning specific roles to your team members, you ensure that individuals only have access to the data necessary for their specific functions.

The portal provides several predefined roles: Administrators, Triage Coordinators, Technical Assessors, and Compliance Officers. Administrators have global access to portal settings and user management. Triage Coordinators are the first line of defense, responsible for initial intake, validation, and communication with external researchers. Technical Assessors are granted access to specific vulnerability details required to reproduce and patch the issue, while Compliance Officers have read-only access to audit logs and SLA metrics to ensure regulatory adherence.

Custom roles can also be configured to meet the unique structural needs of your organization. Every action performed within the portal, regardless of the assigned role, is immutably logged to provide a comprehensive audit trail. This level of granular control and accountability is vital for demonstrating compliance during regulatory audits and maintaining the confidentiality of unpatched vulnerabilities.

Removing Team Members​

Only company administrators can remove members from a team.

Steps to Remove a Member​

  1. Open Settings and select Team.
  2. Find the team member in the Team Members table.
  3. Select Remove in the Actions column.
  4. Review the confirmation dialog.
  5. Select Remove Member to complete the action.

Removal Limits and Behavior​

  • Current user restriction: An administrator cannot remove their own current user account. Another administrator must remove the account if required.
  • Last administrator protection: An administrator cannot remove the last administrator of the company. The company must retain at least one administrator.
  • Access revocation: Removal immediately revokes all active sign-in sessions for the removed user.
  • Ownership cleanup: Removal clears coordinatorId assignments on active submissions and clears ownerUserId and ownerEmail assignments on compliance controls.
  • Audit logging: The portal records a TEAM_MEMBER_REMOVED event in the audit log with the administrator ID and timestamp.