Does Cert-IST have a vulnerability disclosure policy?

Yes. The disclosure policy is available in the "Presentation - Vulnerability disclosure Policy" section.