Re: Duty of care
And this document explains the rules MS have used since I can remember. You need to then apply that to duty of care.
The process is about using the resources they have to fix the problems that matter in a timely manner. The question is, of course, whether that falls within duty of care. This gives more transparency into the process they use, it doesn't affect the process itself.
And it says that problems that have a high priority will be fixed ASAP and problems that have little or no security risk will be put to one side until there is time to deal with them, or incorporate it into the next release.
Biting the hand that feeds IT
