A good vulnerability disclosure policy states what is in scope, what testing is allowed, where to send reports, that you will not pursue good-faith researchers, and when reporters can expect a reply. CISA's Binding Operational Directive 20-01 lists these elements for U.S. federal agencies, and they work for anyone.
The checklist
From BOD 20-01, a policy includes:
- Scope. At least one internet-accessible production system in scope at publication.
- Permitted testing. Types of testing allowed or expressly prohibited, plus a statement that discovered personal information must not be disclosed to third parties.
- Reporting instructions. Where to send reports, such as a form or an email address, the details you need to analyze a report, and a clear statement that anonymous reports are allowed.
- Legal safe harbor. A commitment not to recommend or pursue legal action against good-faith research that follows the policy, and a statement that such activity is authorized.
- Response expectations. When reporters can expect an acknowledgment, and a pledge to be as transparent as possible about remediation.
- Issuance date.
Things the directive says not to do
BOD 20-01 says policies must not require personal information from reporters, limit testing to vetted parties or U.S. citizens, or restrict reporters from disclosing beyond a reasonably time-limited response period.
Timelines
CISA recommends, but does not mandate, acknowledging reports within 3 business days, completing an initial assessment within 7 days and resolving within 90 days. Pick targets you can meet. A missed promise annoys researchers more than a longer promise.
Additions from OWASP
OWASP's disclosure cheat sheet adds practical points:
- Publish a security.txt file. See how to write one.
- Train frontline staff to recognize and escalate security reports.
- Send regular status updates even when no date is firm.
- Keep communication professional, and never threaten researchers with legal action.
- Offer retesting, request CVE IDs where appropriate, and publish advisories with affected and fixed versions and credit.
- Have a qualified lawyer write your terms.
Handling inbound reports
Decide who triages, who fixes and who replies. Track each report like a ticket. A shared mailbox that nobody owns is the most common failure. For high volume, think about a platform, but only after the basics work. See VDP or bug bounty.
Quick check
Do private companies need to follow BOD 20-01?
No, it binds federal agencies. It is a useful model, not a legal requirement for you.
Is safe harbor optional?
BOD 20-01 treats it as a required element for agencies. For anyone else, researchers will often skip programs without it.
Sources
Last reviewed: 19 October 2026.
