I saw that yesterday Enisa (EU cybersecurity agency) quietly released a report on developing national vulnerability initiatives & programmes. It's primarily targeted at public sector organisations within the EU, but it's still of interest to private sector organisations too.

https://www.enisa.europa.eu/publications/developing-national-vulnerabilities-programmes

Developing National Vulnerabilities Programmes

Based on the experiences and perspectives gathered from industry players and national governments, as well as on the documentation developed by multiple actors involved with national vulnerability initiatives and programmes, the EU Coordinated Vulnerability Disclosure (CVD) ecosystem remains fragmented. Although interesting approaches and initiatives are taking place in some EU Member States, yet further steps can be done towards an integrated EU vision and action.

ENISA

@garethwilliams thanks. It's quite difficult to navigate EU-relevant polices websites cos it's like the EU org itself, multi-layered

https://www.enisa.europa.eu/topics/national-cyber-security-strategies

National Cybersecurity Strategies

In a constantly changing cyber threats environment, EU Member States need to have flexible and dynamic cybersecurity strategies to meet new, global threats.

ENISA