I saw that yesterday Enisa (EU cybersecurity agency) quietly released a report on developing national vulnerability initiatives & programmes. It's primarily targeted at public sector organisations within the EU, but it's still of interest to private sector organisations too.
https://www.enisa.europa.eu/publications/developing-national-vulnerabilities-programmes
Developing National Vulnerabilities Programmes
Based on the experiences and perspectives gathered from industry players and national governments, as well as on the documentation developed by multiple actors involved with national vulnerability initiatives and programmes, the EU Coordinated Vulnerability Disclosure (CVD) ecosystem remains fragmented. Although interesting approaches and initiatives are taking place in some EU Member States, yet further steps can be done towards an integrated EU vision and action.