ASD ISM 1755 Develop and maintain a vulnerability disclosure policy

The organisation's management team should establish a clear policy for disclosing software vulnerabilities.

This policy should outline what information to collect, how to protect the privacy of the reporters, and who in the organisation will handle these reports. Make sure the policy is written in clear language and is easily accessible to everyone involved.

The communications or IT team should set up a dedicated channel, such as a specific email address, for receiving vulnerability reports.

This ensures that people know where to send their findings, and the organisation can track reports efficiently. Advertise this contact information on your website and any relevant documentation.

Appoint a responsible team or individual within the IT department to handle incoming vulnerability reports.

This person or team should review each report, assess its validity, and coordinate any required response or remediation within the organisation. Regularly train this team on best practices for handling sensitive information.

The IT team should work on a step-by-step process for verifying and resolving reported vulnerabilities.

This process might include verifying the existence of a vulnerability, evaluating its impact, and prioritising fixes accordingly. Document each step to ensure consistent handling of each report.

The management team should communicate policy updates and changes with all staff involved periodically.

Hosting regular training sessions around this policy helps ensure everyone understands their role and responsibilities. This keeps the team ready and informed when vulnerabilities are reported.