ASD ISM 1717Implement Security.txt for Vulnerability Disclosure
Official control statement
A 'security.txt' file is hosted for each of an organisation's internet-facing website domains to assist in the responsible disclosure of vulnerabilities in the organisation's products and services.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Ensure a 'security.txt' file is available on each website to aid in reporting vulnerabilities.
What this means in practice
A 'security.txt' file is like a signpost on your website that tells security researchers where they can report any problems they find. This is important for finding and fixing security issues quickly to prevent hackers from causing harm to your business.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Proactive
Classifications
NC, OS, P, S, TS
ISM last updated
Sept 2024
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Guideline
Guidelines for software developmentTopic
Vulnerability disclosure program
Why it matters
If a security.txt file is not hosted on internet-facing domains, researchers may not know how to report issues, delaying fixes and increasing breach risk.
Operational notes
Keep security.txt current (contacts, PGP, policy) on every public domain, and triage/track reports so responses and remediation are timely.
Implementation tips
- The IT team should create a 'security.txt' file for the website. This file should include contact information, like an email address, where security researchers can report vulnerabilites they find.
- Website administrators should ensure the 'security.txt' file is placed in the well-known location on the website, typically under the '.well-known' directory, so that it is easy to find.
- The security team should regularly review and update the 'security.txt' file. Make sure the contact information is current and add any additional details, such as social media contacts or a link to a vulnerability disclosure policy.
- Management should communicate the existence of the 'security.txt' file to all relevant staff. Ensure everyone knows how to handle incoming vulnerability reports, including who should be notified and what steps to take next.
- The IT team and management should monitor for any reports received through the 'security.txt' file regularly. Set up processes to prioritise and quickly address any reported vulnerabilities to prevent potential issues.
Audit / evidence tips
- AskThe location of the 'security.txt' file: Request the exact URL where the file is hosted on the websiteLook atWhether it is in the expected location, usually '.well-known/security.txt'GoodIt is accessible and contains valid contact information for reporting
- AskConfirmation of the contact details: Request to see the contact details listed in the 'security.txt'Look atAn email address or web form link specifically for reporting vulnerabilitiesGoodClear instructions on how researchers can report issues
- AskThe update schedule: Request the schedule or policy for reviewing the 'security.txt' fileLook atThe frequency and whether recent updates align with the scheduleGoodDocumented evidence that shows regular updates, such as a log or change history
- AskEvidence of staff communications: Request emails or meeting notes where the 'security.txt' file and procedures were discussed with staffLook atAreas where roles and responsibilities are clearly mentionedGoodEvidence that staff understand the process and their role
- AskReceived vulnerability reports: Check how reports have been documented and handledLook atThe response times and actions takenGoodEfficient handling of reports with follow-ups and issue resolution recorded
Cross-framework mappings
How ISM-1717 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
sync_altPartially overlaps(1)expand_less | ||
| Annex A 8.8 | Annex A 8.8 requires organisations to obtain information about technical vulnerabilities and take measures to reduce exposure | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Software development
See all Guidelines for software development controls, or browse the full ASD ISM library.