The project MUST have a documented process for responding to vulnerability reports. (URL required) [vulnerability_response_process]
This is strongly related to vulnerability_report_process, which requires that there be a documented way to report vulnerabilities. It also related to vulnerability_report_response, which requires response to vulnerability reports within a certain time frame.