RFI Q&A for CISA Vulnerability Disclosure Platform VDP 1.10 .pdf

Questions Answers

Will this solution need to integrate into each agency's enterprise Governance, Risk Management and Compliance tool (example: eMass or RSA Archer)?

At this time there is no hard requirement for integration with any specific system at an agency. As identified in the RFI, the platform should allow automated application-level communications between the platform and an external application like an agency issue tracking system, via an API.

This API is mostly likely going to allow Agencies to integrate with their own ticket tracking system. In theory it should be able to link with many different systems via the API.

Will the solution need to collect vulnerability data from vulnerability scanning solutions (ACAS or Retina) via API into the Vulnerability Platform?

No. As stated in the RFI, the intent is to collect identified vulnerabilities from “discovered in internet-accessible information systems of the FCEB agencies.” Those identified products are associated with internal scanning of an Agency’s network.

Can you please clarify the use case around the bug bounty program? Who will be the bounty? Security personnel of FCEB agencies?

n Agency may wish to utilize financial incentives to increase the likelihood that the Vulnerability Reporter user community participates in identifying vulnerabilities on their public facing systems. The bug bounty functionality is intended to facilitate that process.

Would the solution need to integrate into an IT management ticketing system as well to track accountability for remediation?

Integration with any system would again occur through the API. As for remediation tracking, please refer to the RFI document that identifies potential reporting available within the platform.

The platform provides metrics around reports, offering agencies and CISA insight into the reporting process. These may include:

o Number of vulnerability disclosure reports o Number of reported vulnerabilities determined to be valid (e.g., in scope and not false-positive) o Number of currently open and valid reported vulnerabilities o Number of currently open and valid reported vulnerabilities older than 90 days from the receipt of the report o Median time to validate a submitted report o Median time to remediate/mitigate a valid report o Median time to initially respond to the reporter

Questions for Section A “Vulnerability Disclosure Platform Functionality”:

Would CISA fund the VDP for triage and platform costs for FCEB agencies?

Funding of the vulnerability disclosure platform is still under consideration at CISA. As stated in the RFI “FCEB agencies may have to fund some portion of their own participation in the platform”. No further information is available currently.

Questions for Section A “Vulnerability Disclosure Platform Functionality”:

The required scale and cost of triage support in a VDP typically depends on the number of submissions expected through the platform. How many triage personnel would CISA expect for each agency VDP and what submission volume would be used to derive that number?

Expected submission information is not currently available. The Government will take this question into consideration when developing any potential solicitation package.

Questions for Section A “Vulnerability Disclosure Platform Functionality”:

Can the information that would be required by the reporter at the time they create a profile be kept anonymous from the government?

The Government will take this question into consideration when developing any potential solicitation package.

Questions for Section A “Vulnerability Disclosure Platform Functionality”:

What would the privacy requirements be for user supplied profile data?

The Government will take this question into consideration when developing any potential solicitation package.

Questions for Section A “Vulnerability Disclosure Platform Functionality”:

Are there any requirements for data security, in-transit and at-rest, for the vulnerability submissions received as part of the VDP?

Security controls would need to be consistent with requirements as stated in DHS 4300a Sensitive Systems Handbook. Additional information concerning the impact level of the system would be provide in any potential solicitation package.

Questions for Section A “Vulnerability Disclosure Platform Functionality”:

How would the government require the vendor to handle sensitive agency information, such as PII, PHI, and financial data, submitted by a reporter?

Handling of sensitive agency information would be governed by the vulnerability disclosure policy in place at an Agency.

Questions for Section A “Vulnerability Disclosure Platform Functionality”:

If the researcher chooses to disclose the vulnerability publicly (including a fully weaponized proof of concept exploit) simultaneously with submission to the VDP, are there any repercussions for the researcher legally?

Public disclosure of a vulnerability would likely be governed by the vulnerability disclosure policy in place at an Agency.

Questions for Section A “Vulnerability Disclosure Platform Functionality”:

If a researcher extracts sensitive government data or PII on the public or government personnel, will the researcher or VDP platform be held legally responsible for the hacking activity?

Legal protections will be extended to any researcher that complies with the vulnerability disclosure policy in place at an Agency.

As stated in the RFI, the provider will be responsible for “maintaining the security of the platform in alignment with Federal and Department of Homeland Security requirements

Questions for Section B “Vulnerability Disclosure Platform Stakeholders” The Platform Service Provider’s own security posture can impact (positively or negatively) that authorize the system to operate.” security and control of the VDP program. What are the requirements for the Platform Service Provider’s security posture, specifically as it relates to defenses against potential account take-overs?

Questions for Section D “Bug Bounty Functionality”:

Does the statement “ability for agencies to provide bug bounties (financial incentives) for valid submissions” mean that CISA is expecting that all valid submissions be paid for by the agency as a bug bounty or is this functionality optional should an agency choose to use the platform as a VDP only?

No, CISA is not expecting that all valid submission be paid. The functionality must exist in the platform but it is optional for an agency to use it.

Questions for Section D “Bug Bounty Functionality”:

Payment method requirements for vulnerability submissions can vary from platform to platform and from country to country. What payment methods (e.g. certified mail, electronic, etc.) wou be authorized for government use via a platform?

The Government will take this question into consideration when developing any potential solicitation package.

Questions for Section D “Bug Bounty Functionality”:

What payment currency forms (e.g. cash, bitcoin, etc.) are authorized for government use via a platform?

The Government will take this question into consideration when developing any potential solicitation package.

Questions for Section D “Bug Bounty Functionality”:

Are there any requirements around the vetting of an individual before providing payment?

I.e. criminal background check, citizenship verification.

The Government will take this question into consideration when developing any potential solicitation package.

Questions for Section D “Bug Bounty Functionality”:

Are there any limitations (e.g. citizenship, membership affiliations, government employee, etc.) that would affect who can be provided payment?

The Government will take this question into consideration when developing any potential solicitation package.

Questions for Section D “Bug Bounty Functionality” How would disputes be handled during the payment process?

The Government does not envision disputes occurring as they have the sole ability to determine if a vulnerability is valid and meet bug bounty criteria developed by an Agency.

Questions for Section D “Bug Bounty Functionality” What requirements does the government have around the security and privacy of personal a financial information provided by the reporter?

The Government will take this question into consideration when developing any potential solicitation package.

Questions for Section D “Bug Bounty Functionality” Is it OK to provide payments to researchers that are dual citizens of allied nations and foreign countries such as Iran?

Example: Government funds used to pay a UK researcher that is also

The Government will take this question into consideration when developing any potential solicitation package.

Will the research community (ethical hackers) be limited to US Citizens only?

The Government will take this question into consideration when developing any potential solicitation package.

Is FEDRAMP Authorization a requirement? If so, at what level? Currently no FEDRAMP requirement is envisioned. As stated in the RFI, the provider will be responsible for “maintaining the security of the platform in alignment with Federal and Department of Homeland Security requirements that authorize the system to operate.” Currently there is no Fed RAMP requirement, however the use of a Fed RAMP approved vendor could change before any solicitation release.

Will government agencies be free to work on developing their own VDP independent of DHS/CISA? Or will they be mandated to work directly with DHS CISA?

As stated in the RFI “Utilization of the vulnerability disclosure platform will not be mandatory for FCEB agencies”. Agencies will be required to have a Vulnerability Disclosure Policy (see draft BOD referenced in RFI) to participate in this Vulnerability Disclosure Platform.

Will the provider provide an active role actively validating all reports? Yes. As stated in the RFI the provider “Provides screening and initial triage of submissions, validating it appears to be a real weakness displayed in the system. “

Will the system be required to be hosted in Fed ramp datacenters?

Currently there is no Fed RAMP requirement, however the use of a Fed RAMP approved vendor could change before any solicitation release.

Will the application have to be Fed ramp Approved?

Will the application be a prebuilt system or a custom developed by the due date?

As stated in the RFI, the provided will be responsible for “maintaining the security of the platform in alignment with Federal and Department of Homeland Security requirements that authorize the system to operate.”

No additional information aside from saying that the government desires that the vulnerability disclosure platform be a software-as-a-service web application that serves as the primary point of entry for vulnerability reporters to alert the government of potential issues on federal information systems for those agencies that participate in the platform. The ability to utilize existing services would seemingly improve delivery timelines.

Will the system/ CISA ATO the application for Fed ramp status?

As stated above, the RFI states that the provider will be responsible for “maintaining the security of the platform in alignment with Federal and Department of Homeland Security requirements that authorize the system to operate.”

Is the intent a IDIQ where each Agency be funding/awarding a Task Order? No firm determination has been made on acquisition approach.