This page contains a web-friendly version of the Cybersecurity and Infrastructure Security Agency’s Binding Operational Directive 20-01 VDP template. See also the Word template below to accept submissions looks like.

This template is intended to assist your agency in the creation of a vulnerability disclosure policy (VDP) that aligns with Binding Operational Directive (BOD) 20-01 .

Instructions for how to use the template and some example text are provided throughout the document in red and italic text. These should be changed and removed from your published policy.

You are encouraged to modify the template to suit your needs, but your policy must address all actions required by the Directive.…