Company

The legal entity that will sign the declaration. Address and number appear on it.

Goes into security.txt · 09 technical documentation · 10 declaration

Legal name *

Legal form

Trade name (if different)

Registration / company number

Country of establishment *

Website *Used for security.txt, policy URL and declaration.

Street address

Postal code

City

Security contacts

Who receives vulnerability reports and who answers the authorities. One mailbox, one name, one backup.

Goes into security.txt · 02 CVD policy · 03 handling · 04 reporting

Security e-mail *Monitored every working day. Goes into security.txt and the CVD policy.

Vulnerability report form URL (optional)

PGP key URL (optional)

Where the CVD policy will live

Security responsible (name) *

Role

Backup person

Backup e-mail

Phone for authorities

Signatory of the declaration (name)

Signatory function

Product

What you ship, to whom, and how updates reach users. This decides your class and your support period.

Goes into 01 scope memo · 06 support statement · 08 risk · 09 technical documentation · SBOM

Product name *

Current version

Type

Commercial model

Process commitments

Deadlines you commit to in public. The defaults are common practice for a small team; change them only if you will keep them.

Goes into 02 CVD policy · 03 handling · 05 ENISA templates

Acknowledge reports within (working days)

Triage within (days)

Fix critical/high within (days)

Fix others within (days)

Coordinated disclosure after (days)

Monitoring cadence

Security testing you actually do

Procedure review

Publish an acknowledgements page for reporters

Generate your CRA documents

Company

Security contacts

Product

Process commitments

Your kit