Vulnerability Disclosure Policy

Approval #

Revision History #

Review cycle: Every year, and after any change to the scope of internet-accessible systems.

Mandate. The Cybersecurity and Infrastructure Security Agency (CISA) issued Binding Operational Directive 20-01, Develop and Publish a Vulnerability Disclosure Policy, on September 2, 2020. It requires every federal civilian executive branch agency to:

• Publish a vulnerability disclosure policy that authorizes good-faith security research on its internet-accessible systems.
• Bring all such systems into scope. The directive’s final scope milestone was September 2, 2022.
• Keep a process for handling reports.
• Keep the policy current.

The CISO publishes this policy at the /vulnerability-disclosure-policy path on the Organization’s primary .gov domain, where CISA checks for it. The policy also meets National Institute of Standards and Technology (NIST) SP 800-53 RA-5(11). It is written for the researcher who will read it, so it uses plain language throughout.

1. Introduction #

The Organization is committed to keeping its systems and the information they hold safe. This policy describes the systems and types of research it covers, how to send us vulnerability reports, and how long we ask researchers to wait before disclosing a vulnerability publicly. We want researchers to feel comfortable reporting vulnerabilities they discover, and we will work with them in good faith.

2. Authorization #

If you make a good-faith effort to comply with this policy during your security research, we will consider your research authorized. We will work with you to understand and resolve the issue quickly, and the organization will not recommend or pursue legal action related to your research. If a third party brings legal action against you for activities you carry out under this policy, we will make that authorization known.

3. Guidelines #

Under this policy, “research” means activities in which you:

• Notify us as soon as possible after you discover a real or potential security issue.
• Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data.
• Use exploits only to the extent necessary to confirm a vulnerability’s presence. Do not use an exploit to compromise or exfiltrate data, establish persistent command-line access, or pivot to other systems.
• Give us a reasonable amount of time to resolve the issue before you disclose it publicly.
• Do not submit a high volume of low-quality reports.

If you reach sensitive data, stop your test and tell us at once. Sensitive data includes personally identifiable information (PII), financial information, and anyone’s proprietary information or trade secrets. Do not keep the data, and do not share it with anyone.

If at any point you are unsure whether to continue testing, stop and contact us through the reporting channel below.

4. Test Methods That Are Not Authorized #

• Network denial of service tests or other tests that impair access to or damage a system or data.
• Physical testing (office access, open doors, tailgating), social engineering (phishing, vishing), and any other non-technical vulnerability testing.

5. Scope #

This policy applies to every internet-accessible system and service the organization operates, under any of its public domains. A system that a vendor operates for the Organization is in scope only if the vendor has agreed. Please report a vulnerability in a vendor’s own product to the vendor directly. We will help you find the right contact. Any system not expressly listed as out of scope is in scope.

Out of scope: [list any excluded domains, hosts, or services, with the reason].

6. Reporting a Vulnerability #

We accept reports through the vulnerability disclosure platform at [the program’s reporting address]. You may submit a report anonymously. Please include the location of the vulnerability, its potential impact, and the technical steps needed to reproduce it. We accept reports in English. We do not offer monetary rewards under this policy.

7. What You Can Expect From Us #

We will keep you informed as openly as we can, and we will credit researchers who wish to be credited once the issue is resolved.

We use your report only to find and fix vulnerabilities and to defend our systems. If a vulnerability you report affects other organizations, we may share it with CISA so CISA can coordinate disclosure. We will not give CISA your name unless you agree.

8. Handling Process (Internal) #

The Security Operations Center (SOC) triages each report in the vulnerability disclosure platform within one business day and enters it in the vulnerability tracking system. The SOC assigns it to the responsible System Owner, who remediates it on the deadlines in the Vulnerability Management Policy. For every valid report, the SOC checks the logs for use of the vulnerability by anyone other than the researcher, including use before the report. The SOC handles any such use as an incident under the Incident Response Plan. When PII may be involved, the SOC also notifies the Senior Agency Official for Privacy (SAOP), who decides whether the Breach Response Plan applies. The SOC handles a report that shows active exploitation the same way. The SOC uses each report only to fix the vulnerability and defend the Organization’s systems. The vulnerability management lead may share a vulnerability that affects other parties with CISA without naming the reporter, unless the reporter agrees. The vulnerability management lead reports metrics on reports received, validated, and remediated to CISA as the Binding Operational Directive (BOD) 20-01 implementation guidance requires.

9. Questions #

Questions about this policy may be sent through the same intake channel. We also invite you to contact us with suggestions for improving it.