§10306 — Title 22 Foreign Relations and Intercourse | U.S. Code

Summary

The Secretary must create and publish a Vulnerability Disclosure Policy (VDP) within 180 days after December 23, 2022. The VDP must set up how the Department will get reports about security bugs in its internet-facing systems and how it will fix them, following existing federal guidance. The Secretary must also send a report to Congress about that policy. Then, within 180 days after the VDP is set up and once a year for 5 years, the Secretary must report to the relevant Senate and House committees with information on things like how many and how bad the reported vulnerabilities were, how many new ones were fixed, how many still need fixing and the plans to fix them, average time to fix problems, the staff and resources used, how the findings are prioritized, any problems running the VDP, and other relevant topics. A “bug bounty program” means a program that lets approved people or companies look for and report bugs on Department internet-facing systems for pay. Within 180 days after December 23, 2022, the Secretary must tell Congress about any work to set up or run such a program. If a bug bounty program is started, the Secretary must report to certain Senate and House committees within 180 days with details like numbers of participants (registered, approved, who submitted reports, who got paid), counts and severity of reported vulnerabilities, how many new ones were fixed, outstanding issues and plans, average fix time, types of payment, lessons learned, public contact info, how findings are folded into existing processes, and any challenges or scope changes.

Title 22, §10306

Foreign Relations and Intercourse — Source: USLM XML via OLRC

(a)In this section:

(1)The term “bug bounty program” means a program under which an approved individual, organization, or company is temporarily authorized to identify and report vulnerabilities of internet-facing information technology of the Department in exchange for compensation.

(2)The term “information technology” has the meaning given such term in section 11101 of title 40.

(b)(1)Not later than 180 days after December 23, 2022, the Secretary shall design, establish, and make publicly known a Vulnerability Disclosure Policy (referred to in this section as the “VDP”) to improve Department cybersecurity by—

(A)creating Department policy and infrastructure to receive reports of and remediate discovered vulnerabilities in line with existing policies of the Office of Management and Budget and the Department of Homeland Security Binding Operational Directive 20–01 or any subsequent directive; and

(B)providing a report on such policy and infrastructure to Congress.

(2)Not later than 180 days after the establishment of the VDP pursuant to paragraph (1), and annually thereafter for the following 5 years, the Secretary shall submit a report on the VDP to the Committee on Foreign Relations of the Senate, the Committee on Homeland Security and Governmental Affairs of the Senate, the Select Committee on Intelligence of the Senate, the Committee on Foreign Affairs of the House of Representatives, the Committee on Homeland Security of the House of Representatives, and the Permanent Select Committee on Intelligence of the House of Representatives that includes information relating to—

(A)the number and severity of all security vulnerabilities reported;

(B)the number of previously unidentified security vulnerabilities remediated as a result;

(C)the current number of outstanding previously unidentified security vulnerabilities and Department of State remediation plans;

(D)the average time between the reporting of security vulnerabilities and remediation of such vulnerabilities;

(E)the resources, surge staffing, roles, and responsibilities within the Department used to implement the VDP and complete security vulnerability remediation;

(F)how the VDP identified vulnerabilities are incorporated into existing Department vulnerability prioritization and management processes;

(G)any challenges in implementing the VDP and plans for expansion or contraction in the scope of the VDP across Department information systems; and

(H)any other topic that the Secretary determines to be relevant.

(c)(1)Not later than 180 days after December 23, 2022, the Secretary shall submit a report to Congress that describes any ongoing efforts by the Department or a third-party vendor under contract with the Department to establish or carry out a bug bounty program that identifies security vulnerabilities of internet-facing information technology of the Department.

(2)Not later than 180 days after the date on which any bug bounty program is established, the Secretary shall submit a report to the Committee on Foreign Relations of the Senate, the Committee on Homeland Security and Governmental Affairs of the Senate, the Committee on Foreign Affairs of the House of Representatives, and the Committee on Homeland Security of the House of Representatives regarding such program, including information relating to—

(A)the number of approved individuals, organizations, or companies involved in such program, disaggregated by the number of approved individuals, organizations, or companies that—

(i)registered;

(ii)were approved;

(iii)submitted security vulnerabilities; and

(iv)received compensation;

(B)the number and severity of all security vulnerabilities reported as part of such program;

(C)the number of previously unidentified security vulnerabilities remediated as a result of such program;

(D)the current number of outstanding previously unidentified security vulnerabilities and Department remediation plans for such outstanding vulnerabilities;

(E)the average length of time between the reporting of security vulnerabilities and remediation of such vulnerabilities;

(F)the types of compensation provided under such program;

(G)the lessons learned from such program;

(H)the public accessibility of contact information for the Department regarding the bug bounty program;

(I)the incorporation of bug bounty program identified vulnerabilities into existing Department vulnerability prioritization and management processes; and

(J)any challenges in implementing the bug bounty program and plans for expansion or contraction in the scope of the bug bounty program across Department information systems.

Statutory Notes and Related Subsidiaries

Definitions “Department” and “Secretary” as used in this section mean the Department and Secretary of State, unless otherwise specified, see section 9002 of Pub. L. 117–263, set out as a note under section 2651 of this title.

§10306 Vulnerability disclosure policy and bug bounty program report

Summary

Title 22, §10306

Notes & Related Subsidiaries

Statutory Notes and Related Subsidiaries

Citations & Metadata