This should be work for the ENISA: https://www.enisa.europa.eu/
https://www.enisa.europa.eu/topics/vulnerability-disclosure
They have a tender going on tracking best practices: https://www.enisa.europa.eu/procurement/vulnerability-disclo...
So they will take 12 months to select for the tender...18 months pondering on the report...and in 3 years they make a tender out for a solution...