Guidelines on the disclosure process for security vulnerabilities relating to information systems, including Internet of Things devices
Don't show this message again
(a) In generalNot later than 180 days after December 4, 2020, the Director of the Institute, in consultation with such cybersecurity researchers and private sector industry experts as the Director considers appropriate, and in consultation with the Secretary, shall develop and publish under section 278g–3 of this title guidelines—
(1) for the reporting, coordinating, publishing, and receiving of information about—
(A)
a security vulnerability relating to information systems owned or controlled by an agency (including Internet of Things devices owned or controlled by an agency); and
(B)
the resolution of such security vulnerability; and