Recital 13 Responsible vulnerability disclosure

To ensure timely and transparent communication of potential security threats that could impact the financial entity and its stakeholders, financial entitiesas defined in Article 2, points (a) to (t) should establish procedures for the responsible disclosure of ICT vulnerabilities means a weakness, susceptibility or flaw of an asset, system, process or control that can be exploited; to clients, counterparts, and the public. When establishing those procedures, financial entitiesas defined in Article 2, points (a) to (t) should consider factors, including the severity of the vulnerability means a weakness, susceptibility or flaw of an asset, system, process or control that can be exploited;, the potential impact of such vulnerability means a weakness, susceptibility or flaw of an asset, system, process or control that can be exploited; on stakeholders, and the readiness of a fix or mitigation measures.