IC Technology & Cyber — 2026-07-22

NSA Partners With Allied Agencies to Release Coordinated Vulnerability Disclosure Framework for Defense and Intelligence Suppliers

BLUFCISA's inability to answer nine disclosure emails over two months while co-authoring allied disclosure standards erodes the credibility needed to impose those requirements on defense suppliers.

CISA, NSA, and three allied cyber agencies, the UK National Cyber Security Centre, the Netherlands NCSC, and Japan's JPCERT/CC, published joint guidance on July 15 titled "Establishing a Coordinated Vulnerability Disclosure Program to Work With Security Researchers" 1. The framework directs software manufacturers and online service providers to publish vulnerability disclosure policies prominently, maintain dedicated reporting channels separate from customer support, acknowledge researcher submissions within two to three business days, and assign CVE identifiers for triaged vulnerabilities 2. CISA acting Executive Assistant Director for Cybersecurity Chris Butera stated that coordinated vulnerability disclosure "is foundational to building a secure software ecosystem" and supports the agency's Secure by Design initiative 3. The guidance's release coincided with CISA's disclosure that it had failed to respond to nine emails from a GitGuardian researcher who discovered exposed AWS GovCloud keys in a public CISA repository on May 15, acknowledging its own internal reporting channels were poorly defined 2.

Analysis
NSA's co-authorship makes this a Five Eyes-plus norm-setting move extending disclosure expectations into defense and intelligence supply chains that have long resisted external researcher access. The guidance may function primarily as a Secure by Design deliverable meant to show policy output rather than compel suppliers who face no contractual incentive to build researcher-facing programs. CISA's admission that it left nine researcher emails on an AWS key exposure unanswered for two months, only acting after media involvement, undermines its standing to mandate the same processes it failed to run internally. Coverage converges across CISA's release and trade press, with only one outlet independently reporting the concurrent CISA lapse the agency's own announcement omitted. Whether the framework functions as an enforceable standard or aspirational messaging remains an open question for suppliers weighing compliance costs.

4 sources

CISA and Partners Publish Guidance to Help Software Manufacturers and Online Service Providers Work With Security Researchers
CISA folds its own hard-won lessons into coordinated vulnerability disclosure guidance - Help Net Security
CISA, International Partners Issue Guidance on Vulnerability Disclosure Programs - ExecutiveGov
NSA Releases Vulnerability Disclosure Program Information - Intelligence Community News