Recommended | HackerOne

Region

Requirement

Policy

FDA Postmarket Guidance for Medical Devices

Applies to

Medical device manufacturers

Provision

Sec. V(B), VII

Description

Section V(B): Manufacturers should implement "Cybersecurity Risk Management Programs" that include "adopting a coordinated vulnerability disclosure policy and practice." Since the rule was published in 2016, it suggests that manufacturers make use of the ISO/IEC 29147:2014 (Information Technology - Security Techniques - Vulnerability Disclosure) Standard, which has since been replaced by a new version in 2018.

Section VII: Manufacturers should "adopt a coordinated vulnerability disclosure policy and practice that includes acknowledging receipt of the initial vulnerability report to the vulnerability submitter"

Date

December 2016

Organization

FDA

View source

Jurisdiction

Region

Requirement

Policy

NIST Cybersecurity Framework 2.0

Applies to

All organizations that use the CSF

Provision

ID.RA.08

Description

"Processes for receiving, analyzing, and responding to vulnerability disclosures are established" within an organization.

Date

February 2024

Organization

NIST

View source

Jurisdiction

Region

Requirement

Policy

NIST SP 800-218, Secure Software Development Framework

Applies to

Software developers

Provision

RV.1.3

Description

RV.1.3: Have a policy that addresses vulnerability disclosure and remediation, and implement the roles, responsibilities, and processes needed to support that policy.

Date

February 2022

Organization

NIST

View source

Jurisdiction

Region

Requirement

Policy

NIST SP 800-216, Recommendations for Federal Vulnerability Disclosure Guidelines

Applies to

Federal agencies and contractors providing IoT devices to the Federal government

Provision

N/A

Description

Implements the requirements listed in the IoT Cybersecurity Improvement Act of 2020 with guidelines: (1) for the reporting, coordinating, publishing, and receiving information about a security vulnerability relating to information systems owned or controlled by an agency (including Internet of Things devices owned or controlled by an agency); and the resolution of such security vulnerability; and (2) for a contractor providing to an agency an information system (including an Internet of Things device) and any subcontractor thereof at any tier providing such information system to such contractor, on— receiving information about a potential security vulnerability relating to the information system; and disseminating information about the resolution of a security vulnerability relating to the information system." The Guidelines are aligned with ISO/IEC 29147 and 30111: "The document defines the Federal Coordination Board (FCB) as the primary interface for vulnerability disclosure reporting and oversight. It also defines Vulnerability Disclosure Program Offices (VDPOs) that are usually part of the Information Technology Security Offices (ITSOs). The FCB and VDPOs work together to address vulnerability disclosure in the Federal Government."

Date

May 2023

Organization

NIST

View source

Jurisdiction

Region

Requirement

Policy

Recommended Criteria for Cybersecurity Labeling of IoT

Applies to

IoT Product Developers

Provision

Section 2.2 - Baseline Product Criteria, Subsection: Documentation (Pg. 8)

Description

Throughout the development lifecycle, the IoT product developer creates or gathers and stores information relevant to the cybersecurity of the IoT product and its product components. With regards to the vulnerability management policies and processes associated with the IoT product, the IoT product developer should a have the following: i. Methods of receiving reports of vulnerabilitiesii. Processes for recording reported vulnerabilitiesiii. Policy for responding to reported vulnerabilities, including the process of coordinating vulernability response activities among component suppliers and third-party vendorsiv. Policy for disclosing reported vulnerabilitiesv. Processes for receiving notification from component suppliers and third-party vendors about any change in the status of their supplied components, such as end of production, end of support, deprecated status (e.g., the product is no longer recommended for use), or known insecurities.

Date

February 2022

Organization

NIST

View source

Jurisdiction

Region

Requirement

Policy

NIST 800-53 Rev 5, Security and Privacy Controls for Information Systems and Organizations

Applies to

Federal agencies and contractors (via FISMA)

Provision

RA-5, SR-8

Description

RA-5: (Vulnerability Monitoring and Scanning) Subsection F states "employ vulnerability monitoring tools that include the capability to readily udpate the vulnerabilities to be scanned." In the discussion of the control, NIST states "vulnerability monitoring includes a channel and process for receiving reports of security vulnerabilities from the public at-large. Vulnerability disclosure programs can be as simple as publishing a monitored email address or web form that can receive reports, including notification authorizing good-faith research and disclosure of security vulnerabilities. Organizations generally expect that such research is happening with or without their authorization and can use public vulnerability disclosure channels to increase the likelihood that discovered vulnerabilities are reported directly to the organization for remediation." SR-8: (Notification Agreements) states to "establish agreements and procedures with entities involved in the supply chain for the system, system component, or system service for the [Selection (one or more): notification of supply chain compromises; results of assessments or audits; [Assignment: organization-defined information]]."

Date

September 2020

Organization

NIST

View source

Jurisdiction

Region

Requirement

Policy

National Cybersecurity Strategy

Applies to

Software developers and vendors

Provision

Strategic Objective 3.3: Shift Liability for Insecure Software Products and Services

Description

"To further incentivize the adoption of secure software development practices, the Administration will encourage coordinated vulnerability disclosure across all technology types and sectors."

Date

March 2023

Organization

White House

View source

Jurisdiction

Region

Requirement

Policy

Executive Order 14028

Applies to

Software developers and vendors (specifically those that supply the federal government, but could also apply to other software developers)

Provision

Sec. 4(e)(viii)

Description

Requires NIST to issue guidance identifying practices that enhance security of the software supply chain. In the guidance NIST must include standards, procedures, or criteria related to, among other issues, "participating in a vulnerability disclosure program that includes a reporting and disclosure process."

Date

May 2021

Organization

White House

View source

Jurisdiction

United Kingdom

Region

Europe

Requirement