CISA and NSA Publish Playbook for Working With Outside Bug Hunters

Key points

• CISA, the NSA and international partners released joint guidance for software makers on running a Coordinated Vulnerability Disclosure programme, a formal way for outside researchers to report security flaws safely.
• The guidance tells companies to publish a written Vulnerability Disclosure Policy explaining how researchers can report bugs without fear of legal trouble.
• It recommends assigning CVE identifiers, the unique tracking numbers used worldwide to catalogue security flaws, to every confirmed vulnerability.
• Smaller vendors are told they can hand the process to a third party such as a national Computer Security Incident Response Team instead of building one in-house.
• The document frames disclosure programmes as a customer protection measure, not a public relations exercise.

The US Cybersecurity and Infrastructure Security Agency, the National Security Agency and a group of overseas partners have published joint advice telling software companies how to work properly with the outside researchers who find flaws in their products.

Released through CISA Cybersecurity Advisories, it's aimed squarely at vendors and online service providers who still don't have a formal way for a stranger to report a bug. The document lays out what a Coordinated Vulnerability Disclosure programme, known as CVD, should look like in practice.

What is coordinated vulnerability disclosure, in plain English?

It's a written agreement between a company and the wider security community about how to report and fix security flaws.

A researcher, sometimes a hobbyist, sometimes a professional, finds a weakness in a product. Without a disclosure programme, they have two bad choices: stay quiet, or post the details publicly and hope the vendor notices. A CVD programme gives them a third option: send the details privately to the company, which confirms the bug, issues a fix, and publishes an advisory once users can protect themselves.

Every programme needs a clear Vulnerability Disclosure Policy, a public-facing document that spells out what researchers are allowed to test, how to submit findings, and a promise the company won't sue them for reporting in good faith.

What does the guidance actually require?

Several concrete things.

Companies should triage incoming reports quickly: read them, confirm whether the bug is real, rank how serious it is. Then remediate, meaning ship a fix to customers.

They should assign a CVE identifier to each confirmed vulnerability. CVE stands for Common Vulnerabilities and Exposures, and each identifier follows the format CVE-YYYY-NNNNN, letting defenders worldwide discuss the same flaw without confusion.

And companies are told to communicate: with the researcher and with the wider industry.

What if a company can't run its own programme?

The advisory acknowledges that not every business has the staff for this.

Small vendors, hardware makers with lean security teams, and operators of niche online services can bring in a third-party intermediary. That might be CISA itself, or a national CSIRT, the Computer Security Incident Response Team run by many governments to coordinate on cyber issues. Those bodies can receive reports on the company's behalf and pass verified findings along.

Why does this matter to ordinary customers?

Because the alternative is worse.

When a company has no disclosure programme, researchers often go public with unpatched bugs out of frustration. Criminals read those posts too. A working CVD process shortens the window between a flaw being found and a fix landing on your phone or laptop.

The guidance carries no fines. But it sets an expectation, and regulators in the US and Australia have been watching vendor behaviour on this closely for years. Our 10 July story on Jen Ellis's decade-long fight to give good-faith researchers legal cover shows exactly how hard it's been to get even this far.

For software companies without a disclosure page, the message is direct: publish one, staff it. Treating outside researchers as a nuisance has a cost, and this guidance makes that cost harder to ignore.