§10306 Vulnerability Disclosure Policy and Bug Bounty Program Report

Summary

Create and publish a Vulnerability Disclosure Policy (VDP) within 180 days after December 23, 2022 to make the Department’s internet-facing systems safer. The VDP must set up a way to receive reports of security problems and fix them in line with existing OMB and DHS guidance. Within 180 days after the VDP is ready, and then once a year for the next 5 years, the Secretary must report about the VDP to these Senate committees: Foreign Relations; Homeland Security and Governmental Affairs; Select Committee on Intelligence; and these House committees: Foreign Affairs; Homeland Security; Permanent Select Committee on Intelligence. Those reports must cover counts and severity of reports, how many new problems were fixed, outstanding problems and fix plans, average fix time, staff and resources used, how findings are prioritized, implementation challenges, and any other relevant details. Bug bounty program: outside testers can be temporarily approved to find and report problems in exchange for pay. Within 180 days after December 23, 2022, the Secretary must tell Congress about any work to set up or run such a program. Then, within 180 days after any bug bounty program starts, the Secretary must report to the Senate Committees on Foreign Relations and Homeland Security and Governmental Affairs and to the House Committees on Foreign Affairs and Homeland Security. That report must include numbers of participants (registered, approved, who reported, who were paid), counts and severity of findings, fixes made and outstanding issues with plans, average fix time, what payments were used, lessons learned, public contact info, how findings are folded into existing processes, and challenges or plans to change the program’s scope.