[ISM] SecDevOps practices:

[SSDF] Collaboration: Establish vulnerability disclosure and collaboration (SSS-02-02-09)

Implement a vulnerability disclosure program (VDP) that invites security researchers to report potential vulnerabilities in products and services. Make program details easily accessible by providing clear guidelines, contact information, and reporting channels, such as a dedicated webpage or contact email. This program fosters collaboration with the security community, enhances early vulnerability detection, and supports the continuous security improvement of products and services. It emphasizes the importance of creating a user-friendly, transparent disclosure program that encourages external security researchers to contribute to product security, directly supporting the goal of proactive vulnerability management.

[SAMM] Establish a coordinated vulnerability disclosure program (SSS-02-02-09-01)

Create a structured vulnerability disclosure program (VDP) to engage external security researchers in reporting vulnerabilities effectively. Include clear reporting guidelines, accessible communication channels (e.g., a dedicated webpage or email), and transparent expectations for response times and follow-up. Assign responsibility for managing the VDP to a dedicated owner or team equipped with the necessary resources to handle reported vulnerabilities promptly and securely. Ensure the program aligns with industry best practices for disclosure, fostering trust and collaboration with the research community. Protect the confidentiality of submitted reports, documenting all findings and actions taken to address vulnerabilities. Regularly review and update the program to accommodate evolving threat landscapes and maintain alignment with regulatory requirements.

Operations

ID	Operation	Description	Phase	Agent
SSS-02-02-09-01-01	Establish reporting guidelines and channels	Define clear and detailed guidelines for reporting vulnerabilities, including the format and required information. Set up accessible communication channels, such as a dedicated webpage or email, to facilitate submissions.	Preparation	Security Teams
SSS-02-02-09-01-02	Assign a dedicated vdp management team	Assign responsibility for managing the VDP to a dedicated owner or team equipped with the tools and resources to handle reported vulnerabilities promptly and securely. Ensure the team is trained in secure report handling and communication.	Preparation	VDP Management Team
SSS-02-02-09-01-03	Define response times and follow-up procedures	Set transparent expectations for response times, including acknowledgment of submissions, initial assessments, and resolution timelines. Develop a follow-up process to keep researchers informed about the progress and outcomes of their reports.	Development	VDP Management Team
SSS-02-02-09-01-04	Protect report confidentiality and document actions	Ensure that all vulnerability reports are handled confidentially. Document all findings, decisions, and actions taken to address vulnerabilities, creating a detailed audit trail for internal use and compliance purposes.	Post-deployment	Compliance Teams
SSS-02-02-09-01-05	Regularly review and update the VDP	Periodically review the VDP to ensure it aligns with evolving threat landscapes, industry best practices, and regulatory requirements. Update reporting guidelines, response procedures, and communication channels as necessary to maintain program effectiveness and trust.	Post-deployment	VDP Management Team

References

Industry framework	Academic work	Real-world case
Information Security Manual (ISM-1780) NIST Secure Software Development Framework (RV.1.3 Example 1) OWASP SAMM: Software Assurance Maturity Model (O-IM-1-B)