Recommendations for Federal Vulnerability Disclosure Guidelines

Published

May 24, 2023

Author(s)

Kim B. Schaffer, Peter Mell, Hung Trinh, Isabel Van Wyk

Abstract

Receiving reports on suspected security vulnerabilities in information systems is one of the best ways for developers and services to become aware of issues. Formalizing actions to accept, assess, and manage vulnerability disclosure reports can help reduce known security vulnerabilities. This document recommends guidance for establishing a federal vulnerability disclosure framework, properly handling vulnerability reports, and communicating the mitigation and/or remediation of vulnerabilities. The framework allows for local resolution support while providing federal oversight and should be applied to all software, hardware, and digital services under federal control.

Citation

Special Publication (NIST SP) - 800-216

Report Number

800-216

NIST Pub Series

Special Publication (NIST SP)

Pub Type

NIST Pubs

Download Paper

https://doi.org/10.6028/NIST.SP.800-216

Local Download

Keywords

advisory, Federal Coordination Body, findings report, source vulnerability report, vulnerability communication, Vulnerability Disclosure, Vulnerability Disclosure Policy, Vulnerability Disclosure Program Office, vulnerability processing, vulnerability tracking.

Citation

Schaffer, K. , Mell, P. , Trinh, H. and Van Wyk, I. (2023), Recommendations for Federal Vulnerability Disclosure Guidelines, Special Publication (NIST SP), National Institute of Standards and Technology, Gaithersburg, MD, [online], https://doi.org/10.6028/NIST.SP.800-216, https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=936658 (Accessed January 23, 2025)