PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Vulnerability Disclosure is Now Mandatory for Federal Agencies - Here's How to Make it Happen

hackerone.com | vulnerability | #cisa | #compliance | #vdp | #vulnerability-disclosure | #government | #policy | #federal-agencies
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

CISA's Binding Operational Directive 20-01 requires federal civilian agencies to publish vulnerability disclosure policies for internet-accessible systems by March 2021, with steps to comply.
Published
Collected

Related coverage

blog · hackerone.com
Report Smarter, Not Harder: HackerOne's Case for Better CIRCIA Rules
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · hackenproof.com
Vulnerability Disclosure Policy: A Guide for Business Leaders
Explains what a vulnerability disclosure policy is and why the EU CRA and NIS2 now make it a compliance expectation, then walks through the key decisions behind each policy section, offering a free template for security and legal teams to adapt.
vulnerability · yeswehack.com
US House passes bill mandating vulnerability disclosure policies for federal contractors
The US House passed a bill mandating VDPs for federal contractors, consistent with NIST guidelines; the roundup also covers the UK Home Office's own vulnerability disclosure policy launch.
blog · bugcrowd.com
CISA’s VDP platform: Five years of collaborative defense
CISA’s VDP Platform marks five years with nearly 45,000 submissions and 5,300+ vulnerabilities fixed across 60+ federal agencies. See the key findings.
blog · about.gitlab.com
GitLab and Claude Code: Fast, compliant AI
GitLab outlines how government agencies can adopt AI coding assistants without losing compliance. GitLab Duo Agent Platform governs Claude Code usage with policy controls, keeping development fast while satisfying regulatory requirements.
blog · aikido.dev
Cyber Resilience Act is here! Myth busting and first impressions
Aikido Security's first impressions of the EU Cyber Resilience Act's first reporting deadline, covering the new Single Reporting Platform, its 24/72-hour and 14-day timelines, and compliance myths.
Back