I found no single rule that makes a vulnerability disclosure program a legal condition of every federal sale. But the CISA attestation form, the SSDF, CISA's bad practices list and the Secure by Demand questions all expect one. A published policy is cheap and answers a question buyers keep asking.
Where the expectation appears
| Source | What it says about disclosure |
|---|---|
| CISA attestation form, item 4(c) | The producer "operates a vulnerability disclosure program and accepts, reviews, and addresses disclosed software vulnerabilities in a timely fashion" |
| NIST SSDF, task RV.1.3 | Have a policy that addresses vulnerability disclosure and remediation, with roles and processes to support it. An example: make it easy for researchers to learn about the program and report |
| CISA Product Security Bad Practices | Not having a published disclosure policy that covers the product is listed as a bad practice |
| Secure by Demand | Buyers can ask whether the manufacturer has published a policy that authorizes testing by members of the public |
The attestation form came from M-22-18, which OMB rescinded in M-26-05. The other three are guidance, and the bad practices document says it is non-binding. Whether a contract requires a program depends on the contract.
What a good policy page contains
- Scope. Which products and domains it covers.
- Authorization. A plain statement that good-faith testing within scope is welcome.
- How to report. A monitored email address or form, and what to include.
- What happens next. An acknowledgment target and a status update promise you can keep.
- Out of scope. Actions you do not allow, such as data destruction or social engineering of staff.
- Safe harbor language. Reviewed by your counsel.
For a longer walk through, see the vulnerability disclosure policy checklist.
Operating it matters more than writing it
An empty inbox is a failure mode. Name an owner, run a test report once a quarter, and log each case from receipt to fix. That log is the evidence behind a statement such as "accepts, reviews, and addresses."
How to answer a buyer
Link the policy, state the acknowledgment target, and give a count of reports handled in the last year if your numbers are reliable. If you have received none, say that and show that the channel works.
Quick check
Is a bug bounty the same as a disclosure program?
No. A disclosure program says how to report and what you will do. A bounty adds payment.
Does the policy need to cover every product?
The bad practices document refers to a policy covering the product. Say clearly which products are in scope.
Try it yourself
Click through it at your own pace, or open it full screen.
Notice how each finding carries a status. A disclosed report should move through the same states.
Safeguard provides vulnerability management features and compliance and evidence automation, which can hold the log of handled reports. Try the free scan at gold.safeguard.sh/scan.
Sources
- CISA attestation form (PDF)
- NIST SP 800-218 Rev. 1 initial public draft (PDF)
- CISA and FBI Product Security Bad Practices
- CISA Secure by Demand guide
- OMB M-26-05
Last reviewed: 19 October 2026.
