D.1.3 Vulnerability disclosure
Control Details
Objective
Aid organizations in responding to vulnerabilities to reduce the window of opportunity for attackers
Definition
Have a policy that invokes vulnerability disclosure and remediation, and organizational response. Implement the roles, responsibilities, and processes needed to support that policy, including a Product Security Incident Response Team (PSIRT) to handle responses to vulnerability reports and incidents. The disclosure program will require insight from internal stakeholders, such as legal, marketing, and public relations.
Assessment Questions
- What is your process for addressing vulnerability disclosure and remediation with roles, responsibilities, and processes in place?
- How do you develop and release security advisories to your software acquirers?
- How do you publish a security policy (e.g. via a security.md file) to inform users about a vulnerability and how to report it?
- How do users know how to report vulnerabilities?
- Who handles PSIRT?