...
Once a reporter has submitted a vulnerability report, they will receive an email with the VRF# (Vulnerability Reporting Form Number) as an acknowledgment of receipt of the report. At this point, the submission is placed in the "Pending" state, shown by the "Pending" tag within the report. Reporters can view their submitted reports that are in the "Pending" state by clicking on "My Vulnerability Reports" in the left menu bar.
If the CERT/CC has coordinators have questions for the reporter before accepting the case for coordination (while it is still in the "Pending" state), we can comment directly on the VRF# with our questions. When this happens, the reporter will get an email stating that there was an update to their vulnerability report. They will need to log into VINCE and check their vulnerability report for the update.
If a reporter wants to share more information with the CERT/CC coordinators while their case is still pending, they can add comments or files directly to the VRF#. To do this, they need to select the VRF# within the "My Vulnerability Reports" page and scroll below their report to find the comment box and file upload area.
...
- An email sent to ?? notifying your organization that they have been added to an open vulnerability case
- A banner(something else? a banner?)
Getting added to a case
If you have been told about an existing vulnerability case from a group already involved and believe that you should be involved, you can contact the coordinators to be added to the case. From the "Inbox", click the button "New Message" and choose "request for Vendor Access to a Case" from the "Why are you contacting us?" dropdown.
Participating in the case discussion
other comms: pointer to comms, private thread, PM to coordinator
...