In order to meet the essential vulnerability requirements, manufacturers must take the following actions:
Document all vulnerabilities and product components.
Address and fix vulnerabilities immediately.
Regularly test and review product security.
Publicly disclose information about vulnerabilities that have been fixed.
Establish and enforce coordinated vulnerability disclosure policies.
Encourage information sharing about vulnerabilities and provide a contact for reporting.
Establish mechanisms for distributing updates that minimize exploitable vulnerabilities securely.
Provide security patches promptly and free of charge, along with a clear explanation of their purpose to users.