> Why not let the organization self decide this? Or one-out-of-two? I think there could be two different situations. In the first one, the company doesn't want

> Why not let the organization self decide this? Or one-out-of-two? I think there could be two different situations. In the first one, the company doesn't want to let the pubilc know about a vulnerability they had to not damage their image. But the CCB gives permission after the vulnerability has been patched. The second one is that the company gives permission, but the CCB wants to wait to first evaluate how many companies could have the same problem and get in touch with them. Think e.g. a vulnerability that can be potentially widespread like log4j.