PRIA, Government Policy, Made Personal

Summary

Require the Secretary to create and publish a Vulnerability Disclosure Policy (VDP) within 180 days after December 23, 2022. The VDP must set up how the Department takes reports of security holes in its internet-facing systems and fixes them, and must include a report to Congress. For 5 years after the VDP starts, the Secretary must send annual reports to the Senate and House committees that handle foreign relations, homeland security, and intelligence. Those reports must say how many and how severe the reported problems were, how many new problems were fixed, how many remain and the Department’s plans, average time to fix problems, the staff and resources used, how the findings are prioritized, any problems in running the VDP, and other relevant points. Definitions: “Bug bounty program” — a temporary, approved program that lets outside people or companies find and report Department internet security flaws for pay. “Information technology” — has the meaning given in Title 40, section 11101. The Secretary must also report to Congress within 180 days after December 23, 2022 about any work to start a bug bounty program, and must report within 180 days after any program starts with details on participants, reports, fixes, payments, lessons, contact info, and related issues.

Title 22, §10306

Foreign Relations and Intercourse, Source: USLM XML via OLRC

(a)Definitions

In this section: (1) Bug bounty program

(2)Information technology

The term “information technology” has the meaning given such term in section 11101 of title 40.

(b)Vulnerability Disclosure Policy

(1)In general

Not later than 180 days after December 23, 2022, the Secretary shall design, establish, and make publicly known a Vulnerability Disclosure Policy (referred to in this section as the “VDP”) to improve Department cybersecurity by—

(A)creating Department policy and infrastructure to receive reports of and remediate discovered vulnerabilities in line with existing policies of the Office of Management and Budget and the Department of Homeland Security Binding Operational Directive 20–01 or any subsequent directive; and

(B)providing a report on such policy and infrastructure to Congress.

(2)Annual reports

Not later than 180 days after the establishment of the VDP pursuant to paragraph (1), and annually thereafter for the following 5 years, the Secretary shall submit a report on the VDP to the Committee on Foreign Relations of the Senate, the Committee on Homeland Security and Governmental Affairs of the Senate, the Select Committee on Intelligence of the Senate, the Committee on Foreign Affairs of the House of Representatives, the Committee on Homeland Security of the House of Representatives, and the Permanent Select Committee on Intelligence of the House of Representatives that includes information relating to—

(A)the number and severity of all security vulnerabilities reported;

(B)the number of previously unidentified security vulnerabilities remediated as a result;

(C)the current number of outstanding previously unidentified security vulnerabilities and Department of State remediation plans;

(D)the average time between the reporting of security vulnerabilities and remediation of such vulnerabilities;

(E)the resources, surge staffing, roles, and responsibilities within the Department used to implement the VDP and complete security vulnerability remediation;

(F)how the VDP identified vulnerabilities are incorporated into existing Department vulnerability prioritization and management processes;

(G)any challenges in implementing the VDP and plans for expansion or contraction in the scope of the VDP across Department information systems; and

(H)any other topic that the Secretary determines to be relevant.

(c)Bug bounty program report

(1)In general

Not later than 180 days after December 23, 2022, the Secretary shall submit a report to Congress that describes any ongoing efforts by the Department or a third-party vendor under contract with the Department to establish or carry out a bug bounty program that identifies security vulnerabilities of internet-facing information technology of the Department.

(2)Report

Not later than 180 days after the date on which any bug bounty program is established, the Secretary shall submit a report to the Committee on Foreign Relations of the Senate, the Committee on Homeland Security and Governmental Affairs of the Senate, the Committee on Foreign Affairs of the House of Representatives, and the Committee on Homeland Security of the House of Representatives regarding such program, including information relating to—

(A)the number of approved individuals, organizations, or companies involved in such program, disaggregated by the number of approved individuals, organizations, or companies that—

(i)registered;

(ii)were approved;

(iii)submitted security vulnerabilities; and

(iv)received compensation;

(B)the number and severity of all security vulnerabilities reported as part of such program;

(C)the number of previously unidentified security vulnerabilities remediated as a result of such program;

(D)the current number of outstanding previously unidentified security vulnerabilities and Department remediation plans for such outstanding vulnerabilities;

(E)the average length of time between the reporting of security vulnerabilities and remediation of such vulnerabilities;

(F)the types of compensation provided under such program;

(G)the lessons learned from such program;

(H)the public accessibility of contact information for the Department regarding the bug bounty program;

(I)the incorporation of bug bounty program identified vulnerabilities into existing Department vulnerability prioritization and management processes; and

(J)any challenges in implementing the bug bounty program and plans for expansion or contraction in the scope of the bug bounty program across Department information systems.

Statutory Notes and Related Subsidiaries

Definitions “Department” and “Secretary” as used in this section mean the Department and Secretary of State, unless otherwise specified, see section 9002 of Pub. L. 117–263, set out as a note under section 2651 of this title.

§10306 Vulnerability Disclosure Policy and Bug Bounty Program Report

Summary

Title 22, §10306

Notes & Related Subsidiaries

Statutory Notes and Related Subsidiaries

Citations & Metadata