Federal VDP Program Shows Early Success

In the first 18 months of its existence, the federal government launched its vulnerability disclosure platform, the 40 participating agencies have received more than 1,300 valid bug reports, nearly 200 of which were for critical vulnerabilities in agency systems.

The establishment of the government’s VDP was the result of a 2020 binding operational directive from the Cybersecurity and Infrastructure Security Agency (CISA) that required all civilian federal agencies to develop a vulnerability disclosure policy (VDP). Although VDPs have become relatively …

agency binding operational directive bug critical critical vulnerabilities disclosure federal federal government government operational operational directive platform program reports result systems valid vdp vulnerabilities vulnerability vulnerability disclosure