Disclosure Policy
What is Disclosure Policy?
A documented policy defining how an organization handles the reporting and disclosure of security vulnerabilities found in its systems.
Terms that appear alongside disclosure policy
Each of these is named in at least one of the same controls as disclosure policy. The number is how many controls name both.
- policy 13 shared controls
- vulnerability 12 shared controls
- vulnerability disclosure 12 shared controls
- cve 3 shared controls
- cybersecurity 3 shared controls
- cisa 2 shared controls
Frameworks that govern disclosure policy
What the standards actually require on disclosure policy
Requirements naming disclosure policy across 6 standards, quoted from the control text.
Manufacturers must put in place and enforce a policy on coordinated vulnerability disclosure.
eu-cyber-resilience-act::Annex I Part II(5) · Coordinated vulnerability disclosure policy →An agency must carry out a risk assessment to decide which of its systems and services the agency VDP (vulnerability disclosure policy) will cover.
new-zealand-information-security-manual-nzism::5.9.23.C.01 · 5.9.23.C.01 Risk assessment to scope the vulnerability disclosure policy →Publish a policy that authorises testing of all the manufacturer's products and states the conditions, gives legal safe harbour for good-faith testing within the policy, and permits public disclosure after a set timeline;
secure-by-design-a-guide-for-manufacturers-cisa::P2-PD6 · Publish a vulnerability disclosure policy →The manufacturer publishes a vulnerability disclosure policy that at least gives contact information for reporting issues, timelines for acknowledging receipt of a report, and timelines for status updates to the reporter until the issue is resolved.
etsi-en-303-645::Provision 5.2-1 · Public vulnerability disclosure policy →Have a policy that addresses vulnerability disclosure and remediation, and implement the roles, responsibilities, and processes needed to support it.
SP800-218-RV.1.3 · Vulnerability Disclosure Policy →OSPS-VM-01 Publish Coordinated Vulnerability Disclosure Policy (maturity levels 2, 3). Requirement: The project documentation MUST include a policy for coordinated vulnerability disclosure (CVD), with a clear timeframe for response.
openssf-open-source-project-security-baseline-osps-baseline::OSPS-VM-01.01 · OSPS-VM-01.01 Publish Coordinated Vulnerability Disclosure Policy →Questions people ask about disclosure policy
What is Disclosure Policy?
Why is Disclosure Policy important for compliance?
Which compliance frameworks address Disclosure Policy?
Where can I learn more about Disclosure Policy?
See how Disclosure Policy applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.