A product security lead or general counsel needs to draft or review a Vulnerability Disclosure Policy (VDP) that clearly defines safe harbour protections for good-faith researchers, establishes scope, sets response timeline commitments, and is consistent with ISO/IEC 29147, CISA guidance, and applicable computer fraud legislation in the organisation's key jurisdictions.