Item 4c of the CISA form asks the producer to operate a vulnerability disclosure program that "accepts, reviews, and addresses disclosed software vulnerabilities in a timely fashion." The form does not mention a bug bounty, a platform or payments. A clear way to report, a person who reviews, and a record of action is what the text describes.
The exact requirement
Section III, item 4c reads that the producer "operates a vulnerability disclosure program and accepts, reviews, and addresses disclosed software vulnerabilities in a timely fashion and according to any timelines specified in the vulnerability disclosure program or applicable policies."
Three verbs carry the weight: accepts, reviews, addresses. The timing rule points to your own stated timelines, so the form leans on you to publish realistic ones and then meet them.
EO 14028 section 4(e)(viii) is the origin: "participating in a vulnerability disclosure program that includes a reporting and disclosure process." Neither text says the program must pay rewards.
What a minimal program contains
| Element | What it looks like |
|---|---|
| Intake | A security contact address or form, listed on your website and in a security.txt file |
| Scope | Which products and domains are covered |
| Safe harbor language | A statement of how you treat good faith research (have counsel word it) |
| Triage owner | A named role who reads every report |
| Response targets | Acknowledgement and fix intentions, stated honestly |
| Closure | A reply to the reporter and, where suitable, a public advisory |
Evidence to keep
M-22-18 said an agency may ask for "evidence that the software producer participates in a Vulnerability Disclosure Program." Keep these ready:
- The public policy page and its change history.
- A log of received reports with dates for acknowledgement, triage and fix.
- Two or three examples of closed reports, with sensitive details removed.
- The mailbox or ticket queue ownership record, so the intake is demonstrably monitored.
Mistakes that weaken the answer
- A policy page that points to an unmonitored mailbox.
- Promised timelines that the team has never met. The form ties "timely" to your own timelines, so unrealistic ones create a gap.
- No link between disclosure and release process, so a valid report sits in a queue while the next release ships.
- Treating the program as marketing, with no triage owner.
Try it yourself
Click through it at your own pace, or open it full screen.
Watch how a finding moves from detection to triage to fix, and ask where a reported vulnerability would enter that flow in your own team.
Quick check
Do we need a bug bounty to answer item 4c?
The form text does not ask for one. It asks for a program that accepts, reviews and addresses reports in a timely fashion.
Is a security email address enough?
It is the intake part. You also need someone who reviews reports and a process that addresses them, with timelines you can meet.
Sources
Last reviewed: 19 October 2026.
