+RA-05(11) [L] Public Disclosure Program

RA-05(11) [L] Public Disclosure Program

Control

Establish a public reporting channel for receiving reports of vulnerabilities in organizational systems and system components.

Discussion

The reporting channel is publicly discoverable and contains clear language authorizing good-faith research and the disclosure of vulnerabilities to the organization. The organization does not condition its authorization on an expectation of indefinite non-disclosure to the public by the reporting entity but may request a specific time period to properly remediate the vulnerability.

Assessment Objective

a public reporting channel is established for receiving reports of vulnerabilities in organizational systems and system components.

Assessment Method

Examine

Risk assessment policy procedures addressing vulnerability scanning risk assessment vulnerability scanning tools and techniques documentation vulnerability scanning results vulnerability management records audit records public reporting channel system security plan other relevant documents or records

Interview

Organizational personnel with vulnerability scanning responsibilities organizational personnel with vulnerability scan analysis responsibilities organizational personnel with security responsibilities

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti

3. Regolamentazioni correlate

Regolamentazioni

Ticket collegati

Collegamenti
is blocked by RA-05(11) [L] Public Disclosure Program – Assessment Procedure
is blocked by Vulnerability Disclosure Program (VDP)