generated: '2026-09-07'
method: searched
source: https://www.bd.com/en-us/about-bd/cybersecurity?active-tab=4
owner: Becton, Dickinson and Company (BD)
owner_note: >-
  C. R. Bard, Inc. has not operated an independent security program since BD completed its
  acquisition on 2017-12-29. The Bard-heritage product lines are now BD Interventional
  (Peripheral Intervention, Surgery, Urology & Critical Care) and are covered by BD's corporate
  Coordinated Vulnerability Disclosure program. This artifact records the PARENT's published
  program because it is the only disclosure route a Bard-brand device owner actually has; it is
  not a claim that C. R. Bard runs a program of its own.
program:
  name: BD Coordinated Vulnerability Disclosure
  type: coordinated-disclosure
  bug_bounty: false
  published: true
  url: https://cybersecurity.bd.com/vulnerability-disclosures
  url_resolves_to: https://www.bd.com/en-us/about-bd/cybersecurity?active-tab=4
  reporting: Report an issue form on the BD Cybersecurity Trust Center
  security_txt: false
  security_txt_note: no RFC 9116 /.well-known/security.txt is served on bd.com, www.bd.com or crbard.com
  cve_numbering_authority: true
  cve_note: BD is authorized as a CVE Numbering Authority by the CVE Program.
  coordination_partners:
    - US Food & Drug Administration (FDA)
    - CISA (US Department of Homeland Security)
    - Health-ISAC
scope_note: >-
  Program scope is BD software-enabled medical devices. Bard-heritage hardware without embedded
  software is out of scope by construction.
x-evidence:
  - url: https://cybersecurity.bd.com/vulnerability-disclosures
    http_status: 302
    note: redirects to the BD Cybersecurity Trust Center tab
  - url: https://www.bd.com/en-us/about-bd/cybersecurity?active-tab=4
    http_status: 200
    fetched: '2026-09-07'
  - url: https://www.bd.com/.well-known/security.txt
    http_status: 404
    fetched: '2026-09-07'