Disclosure policy clauses to leave out: lessons from CISA BOD 20-01

A disclosure policy works only if researchers trust it. CISA's BOD 20-01 prohibits federal agency policies from requiring personal information, limiting testing to vetted parties or citizens, restricting disclosure beyond a reasonable time limit, or routing reports into an equities process. Private companies can learn from the same list.

Context

BOD 20-01 applies to federal civilian agencies, so it is not a rule for private companies. It is still a well worked example of what a policy should and should not contain. Read it as a design reference.

Clauses it prohibits

Requiring personal information. The directive says agencies may ask for voluntary contact details but must not require them. It also says a policy must state that reporters can submit anonymously. A company that demands a name, phone number and employer will lose reports from people who fear retaliation.

Limiting testing to vetted parties or citizens. Policies must not restrict who may test. Locking research to a pre approved list defeats the purpose of an open channel.

Restricting disclosure beyond a reasonably time limited response period. An indefinite gag clause is out. Reporters need to know they can talk about their work after you have had a fair chance to fix it. Your policy can ask for time, and should name how long.

Sending reports to a secrecy process. The directive bars submitting reports to the Vulnerabilities Equities Process or a similar process. The private sector equivalent is sitting on reports for business reasons, or quietly using them. Do not.

Clauses it requires, which belong in yours

• Scope: at least one production system or service named, with broad categories encouraged.
• Which testing types are allowed, and which are not authorised.
• A ban on disclosing personal information found during testing to third parties.
• Where to send reports, and what to include.
• A commitment not to recommend or pursue legal action for good faith research that follows the policy, treating that activity as authorised.
• When reporters can expect acknowledgment, and a promise to be as transparent as possible about remediation.

Optional clause: no payment

The directive says a policy may state that reporters receive no payment and waive compensation claims, and may link to a separate bounty policy. If you take this approach, say it clearly. Surprises about money cause the angriest exchanges.

Other clauses that cause trouble

These are common in company policies though not covered by the directive:

• Demands that researchers sign a nondisclosure agreement before testing.
• Vague threats such as "we reserve all legal rights".
• Scope lists that exclude everything real.
• Requirements to delete all findings with no way to confirm the fix.

The OWASP disclosure guidance is blunt: never threaten legal action against researchers.

A quick audit

Take your policy and mark each clause as one of three: invites reporting, neutral, or discourages reporting. If discouraging clauses outnumber inviting ones, rewrite. Ask a security researcher outside your company to read it and tell you what makes them hesitate.

Quick check

Sources

• CISA BOD 20-01: Develop and Publish a Vulnerability Disclosure Policy
• OWASP Vulnerability Disclosure Cheat Sheet

Last reviewed: 19 October 2026.