[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-sp\u002F800-216":3},{"item":4,"lessons":16,"controls":38,"related":60},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-sp","800-216","SP 800-216","SP 800-216: Recommendations for Federal Vulnerability Disclosure Guidelines",5,"US National Institute of Standards and Technology (NIST)","**What it covers.** NIST recommendations for how US federal agencies should receive, assess, coordinate and disclose vulnerability reports in information systems they operate or rely on. It describes roles such as a vulnerability disclosure programme office and coordination with vendors and reporters.\n\n**In practice.** It gives a useful model for any organisation: publish a disclosure policy, provide a safe channel for reports, triage and route them to system owners, coordinate with affected vendors and communicate with reporters. Evidence includes the published policy, case handling records and agreed timelines.\n\n**Common gaps.** Typical gaps are reports that reach no owner, no legal safe harbour language for good faith reporters and poor coordination with third-party vendors. It draws on ISO\u002FIEC 29147 and 30111.",null,"https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fsp800","Find it among NIST SP 800 publications","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18,22,26,30,34],{"slug":19,"title":20,"published_at":21},"google-adjusts-chrome-bug-bounty-rewards-amid-ai-driven-threat-evolution","Google Adjusts Chrome Bug Bounty Rewards Amid AI-Driven Threat Evolution","2026-10-13T18:20:47.688+00:00",{"slug":23,"title":24,"published_at":25},"ai-spam-overwhelms-bug-bounty-programs-forcing-google-to-pause-oss-vrp","AI Spam Overwhelms Bug Bounty Programs, Forcing Google to Pause OSS VRP","2026-10-05T10:20:51.138+00:00",{"slug":27,"title":28,"published_at":29},"silent-patch-and-delayed-disclosure-enabled-multi-chain-cosmos-evm-exploit","Silent Patch and Delayed Disclosure Enabled Multi-Chain Cosmos EVM Exploit","2026-08-28T22:20:24.78+00:00",{"slug":31,"title":32,"published_at":33},"github-restructures-bug-bounty-quality-over-quantity-shifts-researcher-incentives","GitHub Restructures Bug Bounty: Quality Over Quantity Shifts Researcher Incentives","2026-07-22T22:21:39.823+00:00",{"slug":35,"title":36,"published_at":37},"building-effective-coordinated-vulnerability-disclosure-programs","Building Effective Coordinated Vulnerability Disclosure Programs","2026-07-15T16:22:19.34+00:00",[39,44,48,52,56],{"slug":40,"name":41,"problem":42,"stories":43},"patch-management","Automated patch management","Known holes get closed in days, not months.",1,{"slug":45,"name":46,"problem":47,"stories":43},"breach-attack-simulation","Breach and attack simulation","You only find out whether your security tools stop an attack when a real attacker tries.",{"slug":49,"name":50,"problem":51,"stories":43},"soc-automation","SOC automation and AI analysts","Alerts arrive faster than the team can investigate them, so real attacks wait in the queue or are closed unread.",{"slug":53,"name":54,"problem":55,"stories":43},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":57,"name":58,"problem":59,"stories":43},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[61,66,71,76,80,85,90,94],{"family":62,"item":63,"code":64,"title":65,"together":9},"iso","30111","ISO\u002FIEC 30111","ISO\u002FIEC 30111: Vulnerability handling processes",{"family":67,"item":68,"code":69,"title":70,"together":9},"nist-csf","id-ra","ID.RA-1","Risk Assessment",{"family":72,"item":73,"code":74,"title":75,"together":9},"cis","7","Control 7","Continuous Vulnerability Management",{"family":62,"item":77,"code":78,"title":79,"together":9},"29147","ISO\u002FIEC 29147","ISO\u002FIEC 29147: Vulnerability disclosure",{"family":5,"item":81,"code":82,"title":83,"together":84},"800-40","SP 800-40","SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology",4,{"family":67,"item":86,"code":87,"title":88,"together":89},"rs-co","RS.CO-2","Incident Response Reporting and Communication",2,{"family":72,"item":91,"code":92,"title":93,"together":43},"16","Control 16","Application Software Security",{"family":95,"item":96,"code":97,"title":98,"together":43},"owasp","top10-2021-a06","A06:2021","A06:2021 Vulnerable and Outdated Components"]