CISA and partners publish guidance on vulnerability disclosure programs

By Atlas Watchline Staff · Regulatory · July 26, 2026

CISA and partner cybersecurity agencies published guidance for software makers and online service providers on how to work with security researchers who report flaws.

CISA and partner cybersecurity agencies published guidance on July 15 for software manufacturers and online service providers on setting up coordinated vulnerability disclosure programs for security researchers.

CISA said a clear disclosure process can help organizations assess risk, improve vulnerability management and make product-security decisions. It is also meant to give researchers a predictable way to report weaknesses they find in software, networks and hardware.

The document, titled Establishing a Coordinated Vulnerability Disclosure Program to Work With Security Researchers, was published with the NSA, JPCERT/CC, NCSC-NL and NCSC-UK. CISA said the program model is built around a public policy that explains how to report issues, what testing is allowed, what each side should expect during assessment and how organizations should keep researchers updated during the process.

CISA said that well-defined coordinated vulnerability disclosure programs can help organizations manage potential risk and support more informed product-security decisions. The agency also said such programs can improve the way companies handle vulnerabilities as they are reported.

Acting Executive Assistant Director for Cybersecurity Chris Butera said coordinated vulnerability disclosure is foundational to a secure software ecosystem. He said the practices in the guide help protect customers, strengthen products and support CISA’s Secure by Design initiative.

The guidance also reflects CISA’s broader role in what it describes as leading the national effort to manage, uncover and reduce risk to digital and physical infrastructure Americans rely on. For companies that build or host software services, the document adds another federal reference point for handling outside security reports.

CISA said suppliers should establish coordinated vulnerability disclosure programs and build constructive, collaborative relationships with security researchers to improve product security. The guidance says keeping researchers informed helps make the process open and builds trust.

What comes next is implementation by manufacturers and service providers that choose to adopt the framework. CISA’s announcement did not say whether additional guidance or follow-up materials will be released.

Sources

• CISA News

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.

This is the AMP version of the article. Read the full article on Atlas Watchline.