ID08200031 Solicitation Attachment 3 - VDP Demonstration Checklist.pdf

PWS 3.1 Requirement Platform Functionality Key point of entry for vulnerability reporters to alert the government of potential issues on FCEB systems for those agencies that participate on platform.

Platform Functionality Clear way to track reported vulnerabilities and link reports that are related by reporter, vulnerability type, or other purpose.

Platform Functionality Web-based communication mechanism between the reporter and the agency.

Platform Functionality Allows agency users to create and manage role-based accounts for their organization or suborganizations.

Platform Functionality Allows stakeholders to view reported vulnerabilities and update their status as the issues are managed and resolved.

Platform Functionality Allows for vulnerability reports to be made public with agency approval.

Platform Functionality Provides ability to survey platform users.

Platform Functionality Offers an application programming interface (API) to take various actions on vulnerability reports or pull metrics.

Platform Functionality Provide Metrics and reports to CISA and FCEB agencies.

Platform Functionality Permits participating FCEB agencies to add or remove FCEB systems at any time during the period of performance.

Platform Interfaces ‐

Web Application

Provide users (vulnerability reporters, agencies, CISA) direct access to the platform feature set.

Platform Interfaces ‐

Web Application

Allow reporters to submit vulnerabilities, track submissions and their status, and maintain communication (as they choose).

Platform Interfaces ‐

Web Application

Allow agencies to manage submissions and view summary statistics.

Platform Interfaces ‐

Web Application

Allows CISA to adjudicate submissions where the agency is unknown (or has been unresponsive), view statistical data and trends, run reports, export data, and view agency submissions.

Platform Interfaces ‐

Email

Notifications and alerts of submissions and updates can be emailed to the userbase from the platform (submission details are not included in the email). For example: 1) Agencies are alerted on newly created tickets and updates, reporters are notified on ticket updates and closures; 2) and CISA is alerted when certain defined thresholds are met (ticket unresolved for X days, agency accumulating more than X reports without action, etc.).

Bug Bounty

Functionality

The Platform shall include the ability for agencies to provide bug bounties (financial incentives) for valid submissions and allow FCEB agencies to post bounty amounts, on specific systems or services, and share instructions on the bounty program, Bug Bounty

Functionality

Facilitate payment to security researchers for valid vulnerability submission that is eligible for a bounty. Agencies would have ultimate authority to determine that a report is valid and meets criteria for payment.

Platform User

Expectations ‐

Vulnerability Reporters

Have a clear place to report vulnerabilities in FCEB systems without a requirement to need to know which specific agency or component manages the FCEB system.

Platform User

Expectations ‐

Vulnerability Reporters

Can create an account and profile.

Platform User

Expectations ‐

Vulnerability Reporters

Can log into their account to track submissions and their status.

Platform User

Expectations ‐

Vulnerability Reporters

Can be notified by e.g., email of a change in a report’s status (if desired).

Platform User

Expectations ‐

Vulnerability Reporters

Allow reporters to earn recognition or “points” for the valid reports they have submitted.

Platform User

Expectations ‐ FECB

Agencies

Each agency maintains a profile in the platform. FCEB agency superusers can manage their agency profile and their own users, granting and revoking access permissions (e.g. user can edit, user can only read). By logging into the platform interface, agency users can see an agency dashboard with the list of submissions (open/closed) and general statistics.

Platform User

Expectations ‐ FECB

Agencies

Upon reporter’s submission of a vulnerability/it being triaged, the agency is notified (e.g., via email or via the use of the platform API hooked into the agency’s own issue tracking system). The agency can update the submission’s status via the platform’s web interface or API. Once the vulnerability is addressed, the agency can update or close the submission, an action that triggers a notification to the reporter.

Platform User

Expectations ‐ CISA

Manages the administration of agency superuser credentialing to the system.