951700-19-R-0003-Att_J.1_–_Security_Audit_Standards.docx

Security Audit Standards

The Department of State’s Bureau of Democracy, Human Rights, and Labor, the Broadcasting Board of Governor’s Office of Internet Freedom, and the Open Technology Fund agree to apply the following security audit standards to all Recipients that develop, modify, or maintain computer software for anti-censorship and secure communication technologies.

Definitions:

· Funder: The entity providing funds to support anti-censorship and secure communication technologies.

· Recipient: The entity receiving funds to develop, modify, or maintain computer software for anti-censorship and/or secure communication technologies.

· Agreement: The legal instrument used by the Funder to provide funds to the Recipient (e.g. contract, grant, or cooperative agreement.)

· Developed Technology: The software or hardware that has been implemented by the Recipient. This includes technologies developed, modified, or maintained under the Agreement, including all source code, build systems/tools, tests, design diagrams, hardware specifications, computer executable format code, etc.

· Auditor(s): A Funder approved independent third-party organization, which provides comprehensive security assessment audit services or products of Developed Technology.

· Notable Risk: A finding from a security audit that has been deemed to be a significant risk to the users of the Developed Technology. In the course of their business Auditors will provide guidance as to what constitutes significant risk (i.e. A “Critical” or “High” risk on a subjective scale.) Funder has final say on which particular reported issues constitute a Notable Risk that Receipts must take mandatory action to remediate or mitigate.

Standard Requirements:

· Within 60 days of the execution of the Agreement or prior to deployment for public use, the Recipient shall submit all Developed Technology directly to the Auditor which shall include architectural design and source code review.

· The Funder shall designate one or more Auditors to conduct the security audit at no expense to the Recipient.

· The Funder shall review and approve the audit scope of work prior to the start of the audit.

· The third-party security auditor may sign a non-disclosure agreement (NDA) provided by the Recipient, as a condition of accessing and reviewing the Recipient’s Developed Technology. The NDA shall be subject to review and approval by the Funder, and must allow the third-party security auditor to disclose all finding and results of their audit to the Funder, but shall not require disclosure of the Recipient’s source code to the United States Government (USG). The NDA must include public disclosure provisions that allow for public reporting of vulnerabilities by that remain unresolved 180 days after the audit report has been delivered to the Recipient.

· If the Recipient has already within the previous year, or is currently undergoing, a comprehensive security audit conducted by an Auditor or third-party, the Funder may, at their discretion, accept the report from that Auditor or third-party in lieu of requiring a separate audit.

· The Recipient shall resolve all Notable Risks, and provide a report to the Funder outlining the steps they have taken to resolve all issues within 90 days of receiving the report from Auditor. Whenever possible or practicable, the Recipient shall provide documentation to attest to the implementation of changes necessary to resolve significant issues (such as access to public repositories of open-source code, if applicable, with logs of code updates).

· If deemed necessary by the Funder, the Recipient shall undergo a second, follow-up security audit to confirm Notable Risks have been remediated or mitigated.

· If all significant issues have not been resolved by the completion of a second audit, the Funder reserves the right to terminate the Agreement. Upon termination of the Agreement, the third-party auditor has the right to publically disclose all unresolved vulnerabilities.

· The Funder strongly encourages the Recipient to publish the final audit report once all vulnerabilities have been remediated. If any report is publicly disclosed in any manner (i.e. stored in source repository, blog post, web site, public FTP server, etc.) both Auditor and Funder shall be notified at least one week in advance.