Jurisdiction
United States
Region
North America
Requirement
Required
Policy
IoT Cybersecurity Improvement Act 2020
Applies to
Federal agencies and contractors providing IoT devices to the Federal government
Provision
Sec. 5, Sec. 6, Sec. 7
Description
Section 5: (Guidelines on the Disclosure Process for Security Vulnerabilities Relating to Information Systems, Including IOT Devices) NIST must create guidelines "(1) for the reporting, coordinating, publishing, and receiving of information about—(A) a security vulnerability relating to information systems owned or controlled by an agency (including Internetof Things devices owned or controlled by an agency); and B) the resolution of such security vulnerability; and (2) for a contractor providing to an agency an information system (including an Internet of Things device) and any subcontractor thereof at any tier providing such information system to such contractor, on—(A) receiving information about a potential security vulnerability relating to the information system; and (B) disseminating information about the resolution of a security vulnerability relating to the information system."  Section 6: (Implementation of Coordinated Disclosure of Security Vulnerabilities Relating to Agency Information Systems, Including IOT Devices) Federal agencies—in collaboration with OMB—must develop "policies, principles, standards, or guidelines as may be necessary to address security vulnerabilities of information systems". These programs should be consistnet with NIST guidelines and standards. Moreover, "the Federal Acquisition Regulation shall be revised as necessary to implement the provisions under this section."  Section 7: (Contractor Compliance With Coordinated Disclosure of Security Vulnerabilities Relating to Agency IOT Devices) The head of a federal agency is prohibited from "procuring or obtaining, renewing a contract to procure or obtain, or using an Internet of Things device" if the Chief Informatoin Officer determines that doing so would prevent compliance with the guidelines published under section 5. 
Date
December 2020
Organization
Congress / NIST
View source
Jurisdiction
United States
Region
North America
Requirement
Required
Policy
OMB Memo 20-32
Applies to
Federal agencies
Provision
Sections I, II, & III
Description

Section I: Clearly Worded VDP: Agency VDPs shall clearly articulate which systems are in scope and the set of security research activities that can be performed against them to protect those who would report vulnerabilities. Federal agencies shall provide clear assurances that good-faith security research is welcomed and authorized. 

Clearly Identified Reporting Mechanism: Each Federal agency shall clearly and publicly identify where and how Federal information system vulnerabilities should be reported. 

Timely Feedback: Federal agencies shall provide timely feedback to good-faith vulnerability reporters. Once a vulnerability is reported, those who report them deserve to know they are being taken seriously and that action is being taken. Agencies should establish clear expectations for regular follow-up communications with the vulnerability reporter, to include an agency-defined timeline for coordinated disclosure.

Good-Faith Security Research is Not an Incident or Breach: Good-faith security research does not itself constitute an incident or breach under the Federal Information Security Modernization Act of 2014 (FISMA) or OMB Memorandum M-17-12. 

Section II: CISA must publish impelementaiton guidance describing the actions agencies should take to incorporate VDPs into their larger information security programs.

Section III: Each federal agency must develop and implement a VDP.

Date
September 2020
Organization
OMB
View source
Jurisdiction
United States
Region
North America
Requirement
Required
Policy
CISA Binding Operational Directive 20-01
Applies to
Federal agencies
Provision
N/A
Description
Enable Receipt of Unsolicited Reports: Agencies must ensure that they have a designated security contact for their .gov domains and that their email is regularly monitored.  Develop and Publish a Vulnerability Disclosure Policy: VDP must include which systems are in scope; the types of testing that are allowed; a description of how to submit vulnerability reports; a commitment to not recommend or pursue legal action; a statement that sets expections for the reporter and pledges the agency will be as transparent as possible about remediation; and an issuance date. A VDP must not require the submission of PII; limit testing soley to vetted registered parties or US citizens; Attempt to restrict the reporter’s ability to disclose discovered vulnerabilities to others; submit disclosed vulnerabilities to the Vulnerabilities Equities Process or any similar process.  Vulnerability Disclosure Handling Procedures: VDPs must "Describe how: Vulnerability reports will be tracked to resolution; Remediation activities will be coordinated internally; Disclosed vulnerabilities will be evaluated for potential impact17 and prioritized for action; Reports for systems and services that are out of scope will be handled; Communication with the reporter and other stakeholders (e.g., service providers, CISA) will occur; Any current or past impact of the reported vulnerabilities (not including impact from those who complied with the agency VDP) will be assessed and treated as an incident/breach, as applicable. Set target timelines for and track: Acknowledgement to the reporter (where known) that their report was received; Initial assessment (i.e., determining whether disclosed vulnerabilities are valid, including impact evaluation); Resolution of vulnerabilities, including notification of the outcome to the reporter." Reporting Requirements and Metrics: After the VDP is created, federal agencies must report valid/credible reports of newly discovered vulnerabilities on agency systems that could affect other parties in government or industry. CISA Actions: "CISA will monitor agency compliance to this directive and may take actions for non-compliance" and "will review agencies' initial implementation plan that reflects timelines and milestones for their VDP" to cover systems required under OMB's M-20-30.
Date
September 2020
Organization
CISA
View source
Jurisdiction
European Union
Region
Europe
Requirement
Required
Policy
Cyber Resilience Act (CRA)
Applies to
Manufacturers of software and digitally-enabled devices in the EU Single Market
Provision
Annex 1 Sec. 2(5)
Description

Requires manufacturers to put in place and enforce a policy on coordinated vulnerability disclosure. 

Establish a coordinated vulnerability disclosure policy (CVD).

Full compliance deadline: December 10, 2027 

Early reporting obligations: Some provisions, like vulnerability reporting, may apply earlier, starting 21 months after the CRA enters into force


 

Date
December 10, 2024
Organization
European Union
View source
Jurisdiction
United Kingdom
Region
Europe
Requirement
Required
Policy
Product Security and Telecommunications Infrastructure (PSTI) Act
Applies to
Manufacturers, importers and distributors of consumer connectable products in the UK
Provision
Part 1, Chapter 2, Sec. 8 of the PSTI Act & PSTI Regulations 2023, Schedules 1 and 2
Description

The Product Security and Telecommunications Infrastructure Act 2022, Chapter 1 allows the Secretary of State to specify security requirements for connected devices.

PSTI Regulations 2023, Schedule 1, 2 requires that connected device manufacturers:Provide publicly available information on how to report security issues and publish in English at least one point of contact for security issues relating to their products (hardware or software), including when notifiers will receive acknowledgments and status updates, in an accessible, clear and transparent way, without any prior request for personal information.

Date
April 29, 2024
Organization
UK Parliament
View source