Are You Ready for the New NIST Control Around Public Disclosure Programs?

This article explains NIST SP 800-53 Rev 5 control RA-5(11), which requires SaaS vendors to establish a publicly discoverable vulnerability reporting channel, and provides practical guidance for building and evaluating vulnerability disclosure policies (VDPs) for FedRAMP compliance. It details recommended VDP elements—promise, scope, safe harbor, process, and preferences—highlights assessment questions auditors will ask (discoverability, consistency, scope, finding types, safe harbor, and ease of contact), and describes HackerOne and Schellman & Company perspectives and service offerings to help organizations implement compliant VDPs.