Responsible Disclosure
What is Responsible Disclosure?
A security vulnerability reporting practice where researchers privately inform the affected vendor and allow time for patching before public disclosure.
Terms that appear alongside responsible disclosure
Each of these is named in at least one of the same controls as responsible disclosure. The number is how many controls name both.
- vulnerability 4 shared controls
- remediation 4 shared controls
- vulnerability disclosure 3 shared controls
- transparency 3 shared controls
- threat intelligence 2 shared controls
- policy 2 shared controls
- risk assessment 2 shared controls
- nist 2 shared controls
Frameworks that govern responsible disclosure
What the standards actually require on responsible disclosure
Requirements naming responsible disclosure across 6 standards, quoted from the control text.
The plan must require that protection technology effectiveness measurements are authorised, validated and given confidentiality, integrity and availability protection in line with their classification and that risk to them is identified.
api-1164::PR.IP-8 · PR.IP-8 Protection technology effectiveness measurements protected and shared on need to know →There should be transparency and responsible disclosure so that people can understand when they are significantly impacted by AI and can find out when an AI system is engaging with them.
AUAIE-6 · Transparency and explainability →A 'security.txt' file is hosted for each of an organisation's internet-facing website domains to assist in the responsible disclosure of vulnerabilities in the organisation's products and services.
ISM-1717 · Hosting security.txt files for website domains →The entity must document and implement vulnerability management procedures that keep trusted sources of vulnerability information current;
dora-rts-on-ict-risk-management-framework-commission-delegated-regulation-eu-2024-1774::10 · Article 10: Vulnerability and patch management →ISMAP Cloud Operations covers the day-to-day security operations of cloud services. (1) Cloud Security Monitoring and Logging: 24x7 Security Operations Center (SOC) + SIEM Security Information and Event Management + UEBA User and Entity Behaviour Analytics + S...
ISMAP-CloudOperations-Monitoring-Logging-IncidentResponse-NISC-Reporting-Vulnerability-Change-SLA · ISMAP Cloud Operations - Security Monitoring + SIEM + Logging + Incident Response + NISC Reporting + Vulnerability Management + Penetration Testing + Change Management + SLA Management →After deployment including placing on the market, identify and mitigate vulnerabilities and, where appropriate, incidents and patterns of misuse.
japan-ai-guidelines::HP.II · D-II. Post-deployment vulnerabilities, incidents and misuse →Questions people ask about responsible disclosure
What is Responsible Disclosure?
Why is Responsible Disclosure important for compliance?
Which compliance frameworks address Responsible Disclosure?
Where can I learn more about Responsible Disclosure?
See how Responsible Disclosure applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.