Responsible Disclosure
What is Responsible Disclosure?
A security vulnerability reporting practice where researchers privately inform the affected vendor and allow time for patching before public disclosure.
Terms that appear alongside responsible disclosure
Each of these is named in at least one of the same controls as responsible disclosure. The number is how many controls name both.
- vulnerability 4 shared controls
- remediation 4 shared controls
- vulnerability disclosure 3 shared controls
- transparency 3 shared controls
- threat intelligence 2 shared controls
- policy 2 shared controls
- risk assessment 2 shared controls
- nist 2 shared controls
Frameworks that govern responsible disclosure
What the standards actually require on responsible disclosure
Requirements naming responsible disclosure across 6 standards, quoted from the control text.
AI Incident Reporting + Response is critical to learning + accountability + stakeholder protection per Japan AI Guidelines for Business + Hiroshima AI Process Code of Conduct + emerging AI Bill.
JP-AIG-Incident-Reporting-Response-AISI-METI-Notification-G7-Hiroshima-Reporting-Mechanism-Voluntary · Japan AI Guidelines AI Incident Reporting + Response + AISI/METI Notification + G7 Hiroshima Reporting Mechanism + Voluntary + AI Incident Database + OECD AI Incidents Monitor + Sector Regulator Notification + Coordinated Vulnerability Disclosure →There should be transparency and responsible disclosure so people can understand when they are significantly impacted by AI and can find out when an AI system is engaging with them, with timely, reasonable justifications for outcomes.
AUAIE-6 · Transparency and explainability →A 'security.txt' file is hosted for each of an organisation's internet-facing website domains to assist in the responsible disclosure of vulnerabilities in the organisation's products and services.
ISM-1717 · A 'security.txt' file is hosted for each of an organisation's internet-facing website doma →Financial entities shall have crisis communication plans enabling responsible disclosure of major ICT-related incidents or vulnerabilities to clients, counterparts and the public as appropriate, and designate communication policies for internal staff and exter...
DORA-Art.14 · Communication →HKMA C-RAF iCAST (Intelligence-led Cyber Attack Simulation Testing) - mandatory for HIGH inherent risk AIs + optional for medium tier + modeled on UK CBEST + ECB TIBER-EU (verified separately in this corpus) + intelligence-led red team testing methodology.
HKMA-CRAF-iCAST-RedTeam-PurpleTeam-IntelLed · HKMA C-RAF iCAST (Intelligence-Led Cyber Attack Simulation Testing) for HIGH Inherent Risk AIs →ISMAP Cloud Operations covers the day-to-day security operations of cloud services. (1) Cloud Security Monitoring and Logging: 24x7 Security Operations Center (SOC) + SIEM Security Information and Event Management (Splunk + Microsoft Sentinel + IBM QRadar + Su...
ISMAP-CloudOperations-Monitoring-Logging-IncidentResponse-NISC-Reporting-Vulnerability-Change-SLA · ISMAP Cloud Operations - Security Monitoring + SIEM + Logging + Incident Response + NISC Reporting + Vulnerability Management + Penetration Testing + Change Management + SLA Management →Questions people ask about responsible disclosure
What is Responsible Disclosure?
Why is Responsible Disclosure important for compliance?
Which compliance frameworks address Responsible Disclosure?
Where can I learn more about Responsible Disclosure?
See how Responsible Disclosure applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.