U.S. flagAn official website of the United States government
        Here’s how you know
    Goverment symbol**Official websites use .gov**
            A **.gov** website belongs to an official government organization in the United States.
        Lock symbol**Secure .gov websites use HTTPS**
            A lock (
              A locked padlock
                 ) or **https://** means you’ve safely connected to the .gov website. Share sensitive
              information only on official, secure websites.
 Skip to main content JoinDonate
    About
    About
          About
        
About menu block one
  

        
        What We Do
                Our Impact
                Agency FAQs
About menu block two
  

        
        Our Team
                Careers
About menu block three
  

        
        Agency Overview
                            Budget and Performance Plans
                Disability and Accessibility
                Federal Register Notices
                Open Government
                Plain Writing
                Privacy Policy
                Strategic Plan

  

  
Serve
    Serve
          Serve
        
Serve menu block one
  

        
        AmeriCorps
                            AmeriCorps NCCC
                AmeriCorps State and National
                AmeriCorps VISTA
                AmeriCorps Seniors
                            AmeriCorps Seniors Foster Grandparent Program
                AmeriCorps Seniors RSVP
                AmeriCorps Seniors Senior Companion Program
Serve menu block two
  

        
        Volunteer
                            9/11 Day
                MLK Day
Serve menu block three
  

        
        Find Your Fit
                Serve FAQs

  

  
Partner
    Partner
          Partner
        
Partner menu block one
  

        
        How it Works
                            AmeriCorps NCCC
                AmeriCorps Seniors Foster Grandparent
                AmeriCorps Seniors RSVP
                AmeriCorps Seniors Senior Companion
                AmeriCorps State and National
                AmeriCorps VISTA
                Research and Evaluation
                Volunteer Generation Fund
Partner menu block two
  

        
        Partnerships
                Communities and Initiatives
                Funding Opportunities
Partner menu block three
  

        
        Partner FAQs

  

  
Members & Volunteers
    Members & Volunteers
          Members & Volunteers
        
Members & Volunteers menu block one
  

        
        Your Benefits
                Segal AmeriCorps Education Award
                Education Award FAQs
Members & Volunteers menu block two
  

        
        Alumni
                Members in VISTA
Members & Volunteers menu block three
  

        
        Member and Volunteer FAQs
                Safety and Security

  

  
Grantees & Sponsors
    Grantees & Sponsors
          Grantees & Sponsors
        
Grantee & Sponsors menu block one
  

        
        State Service Commissions
                State and National Direct Grantees
                State Subgrantees
                VISTA Sponsors
                Research and Evaluation Grantees
                Volunteer Generation Fund and Days of Service Grantees
Grantee & Sponsors menu block two
  

        
        RSVP Grantees
                Foster Grandparent Program Grantees
                Senior Companion Program Grantees
                Senior Demonstration Program Grantees
                NCCC Project Sponsors
Grantee & Sponsors menu block three
  

        
        Manage Your Grant
                Grantee and Sponsor FAQs

  

  
Newsroom
    Newsroom
          Newsroom
        
Newsroom menu block one
  

        
        News
                Blog
Newsroom menu block two
  

        
        Stories
                Events
Newsroom menu block three
  

        
        In the News
                Communication Resources



  
Contact
    Contact
    JoinDonate
search Breadcrumb
    About
                                                      Agency Overview

              Vulnerability Disclosure Policy
              This Vulnerability Disclosure Policy (VDP) provides details of how discovered vulnerabilities can be reported to AmeriCorps and gives security researchers clear guidelines for conducting vulnerability discovery activities.
      Agency OverviewAgency-Wide Policies and NoticesAmeriCorps Fraud AlertAmeriCorps’ Equity Action PlanBudget and Performance PlansCivil Rights for Employees, Service Members, and VolunteersDigital StrategyDisability and AccessibilityFederal Register NoticesFOIA and the Privacy ActNo FEAR ActOfficial GuidanceOpen GovernmentPlain WritingPrivacy PolicyResults of Grant CompetitionsStatutes and RegulationsStrategic PlanVulnerability Disclosure Policy
                This Policy is designed to ensure the security of AmeriCorps by protecting its information and giving a clear guideline for conducting vulnerability discovery activities and to convey preferences on how to submit discovered vulnerabilities to AmeriCorps. This Policy also facilitates AmeriCorps awareness of otherwise unknown vulnerabilities. It commits AmeriCorps to authorize good faith security research and respond to vulnerability reports and set expectations for reporters.

                    


    What Is the Purpose of this Policy?
  Toggle
  This Vulnerability Disclosure Policy (VDP) provides details of how discovered vulnerabilities can be reported to AmeriCorps and gives security researchers clear guidelines for conducting vulnerability discovery activities. This policy describes what systems and types of research are covered under this policy, how to send AmeriCorps vulnerability reports, and the timeline before AmeriCorps security researchers publicly disclose vulnerabilities.

      


Authorization
  Toggle
  This section reflects AmeriCorps’ commitment to not take legal action against anyone in the public for security research activities that represent a good faith effort to follow the policy.

If you make a good faith effort to comply with this policy during your security research, we will consider your research to be authorized, we will work with you to understand and resolve the issue quickly, and AmeriCorps will not recommend or pursue legal action related to your research. Should legal action be initiated by a third party against you for activities that were conducted in accordance with this policy, we will make this authorization known.

      


Guidelines
  Toggle
  AmeriCorps requires that all vulnerabilities identified during research to be reported to OIT Help Desk by calling 202-606-6600, sending an email to oithd@cns.gov, or by completing the Privacy and Security Incident Report.

Under this VDP, the researcher shall:

Notify AmeriCorps within 1 hour or as soon as possible after discovering a real or potential security issue.
	Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data.
	Only uses exploits to the extent necessary to confirm a vulnerability’s presence. Does not use an exploit to compromise or exfiltrate data, establish persistent command line access, or use the exploit to pivot to other systems.
	Provide AmeriCorps a reasonable amount of time to resolve the issue before disclosing it publicly (not more than 72 hours).
	Not submit a high volume of low-quality reports.Once a researcher has established that a vulnerability exists or encountered any sensitive data (including personally identifiable information, financial information, or proprietary information or trade secrets of any party), **the individual must stop testing, notify AmeriCorps immediately, and not disclose this data to anyone els**e.

      


Test Methods
  Toggle
  The following test methods are authorized but are not limited to:

Network scanning by approved tools (Nessus, AngryIP).
	Log review via Splunk or some other approved tool.
	Other approved Network management tools (i.e Windows Defender, Solarwinds, etc.)
	Observation of a vulnerability.
	Third party report review.The following test methods are not authorized:

Network denial of service (DoS or DDoS) tests or other tests that impair access to or damage a system or data
	Physical testing (e.g. office access, open doors, tailgating), social engineering (e.g. phishing, vishing), or any other non-technical vulnerability testing

      


Scope
  Toggle
  This section defines which internet-accessible systems or services are in scope with this policy.

This policy applies to any Internet facing services to include web servers, mail gateways, utility servers, or VPN gateways. The following systems and services are included:

americorps.gov
	cncs.gov
	cns.gov
	autodiscover.cns.gov
	egrants.cns.gov
	inventory.cns.gov
	owa.cns.gov
	securetransfer.cns.gov
	sts.cns.gov
	vpn.cns.gov
	webvpn.cns.gov
	joinamericorps.gov
	mentor.gov
	mlkday.gov
	nationalservice.gov
	presidentialserviceawards.gov
	serve.gov
	vistacampus.gov
	volunteeringinamerica.govIn addition, this policy applies to devices residing on the following AmeriCorps IP ranges:

152.180.8.128/26
	152.180.134.192/26
	204.124.228.0/22
	12.188.34.32/27
	216.109.83.64/27
	216.33.116.0/26
	209.67.159.0/26

      


Configuration
  Toggle
  All web domains hosted by. gov are configured as such:

The security contact field for each .gov domain registered is: Unsafe@cns.gov

	Security POC Notice:
	A security contact is like a digital front door for outsiders to report observed or suspected security issues at your domain. This could include notifications about compromised accounts, unsolicited email, routing problems or reporting a potential vulnerability.

	A security contact should be capable of evaluating or triaging security reports for your entire domain. We recommend using a team email address specifically for reports and avoiding the use of an individual’s email address.

	Security contact details are made public via the .gov whois (web/port 443) and our published data. You can change your security contact at any time. Removing the contact withdraws it from whois and our published data.
	The “Organization” field for each .gov domain registered is:

	Organization Name: AmeriCorps
	Street Address: 250 E St SW
	City: Washington
	State: District of Columbia
	State / Province: N/A
	Zip Code: 20525 Country: United States

      


Reporting a Vulnerability
  Toggle
  Information submitted under this VDP will be used for defensive purposes only – to mitigate or remediate vulnerabilities. If your findings include newly discovered vulnerabilities that affect all users of a product or service and not solely Agency Name, we may share your report with the Cybersecurity and Infrastructure Security Agency, where it will be handled under their coordinated vulnerability disclosure process. We will not share your name or contact information without express permission.

AmeriCorps accepts vulnerability reports via e -mail address at oithd@cns.gov, or by calling OIT Help Desk at 202-606-6600 with a description of the vulnerability, its location and potential impact. Reports may be submitted anonymously. If you share contact information, we will acknowledge receipt of your report within 3 business days.

**Vulnerability reports can be submitted anonymously and**

**AmeriCorps must NOT:**

Submit Personally Identifiable Information (PII) although the reporter may voluntarily provide contact information.
	Limit testing solely to “vetted” registered parties or U.S. citizens. The policy must provide authorization to the public.
	Attempt to restrict the reporter’s ability to disclose discovered vulnerabilities to others, except for a request for a reasonably time-limited response period.
	AmeriCorps must not submit disclosed vulnerabilities to other agencies or processes.**AmeriCorps must protect any individual reporting vulnerabilities:**

Commit to not recommend or pursue legal action against anyone for security research activities that the agency concludes represents a good faith effort to follow the policy, and deem that activity authorized.
	Set expectations for when the reporter (where known) can anticipate acknowledgement of their report and pledges the agency to be as transparent as possible about what steps it is taking during the remediation process.*Reporters will not receive payment for submitting or disclosing vulnerabilities.***What AmeriCorps expects from a vulnerability reporter:**

In order to help us triage and prioritize submissions, we recommend that your reports:

Describe the location the vulnerability was discovered and the potential impact of exploitation.
	Offer a detailed description of the steps needed to reproduce the vulnerability (proof of concept scripts or screenshots are helpful).
	Be in English, if possible.**What a vulnerability reporter can expect from AmeriCorps**

When you choose to share your contact information with AmeriCorps, we commit to coordinating with you as openly and as quickly as possible:

Within 3 business days, we will acknowledge that your report has been received.
	To the best of our ability, we will confirm the existence of the vulnerability to you and be as transparent as possible about what steps we are taking during the remediation process, including on issues or challenges that may delay resolution.
	We will maintain an open dialogue to discuss issues.

      


Point of Contact
  Toggle
  Questions regarding this policy may be sent to cybersecurity@cns.gov.

      


Document Change History
  Toggle
  **Version**
1.0

**Date**
03/01/2021

**Description**
First issuance. Back to main content Sign up to hear about our latest news, events, and opportunities.
  Sign up for our newsletter
    Footer about
  

        
        About
                            What We Do
                Our Impact
                Our Team
                Careers
                Agency OverviewFooter serve
  

        
        Serve
                            AmeriCorps
                AmeriCorps Seniors
                Volunteer
                Find Your FitFooter partner
  

        
        Partner
                            How it Works
                Funding OpportunitiesFooter Members & Volunteers
  

        
        Members & Volunteers
                            Your Benefits
                Segal AmeriCorps Education Award
                Alumni
                Safety and SecurityFooter grantees & sponsors
  

        
        Grantees & Sponsors
                            eGrants
                History Checks
                LitmosFooter newsroom
  

        
        Newsroom
                            News
                Blog
                Stories
                Events
                In the News
                Communication Resources
      Bringing Americans together to serve communities

Follow us
  
  1-800-942-2677
            
    help@americorps.gov
    USA.gov / Office of Inspector General / FOIA and Privacy Act / Federal Register notices / No FEAR Act/ Employee Whistleblower Rights / Contractor and Grantee Whistleblower Rights / Office of Special Counsel / STOCK Act / Fraud Alert

Accessibility / Privacy policy / Site map / Donate / Join

**AmeriCorps.gov**
An official website of AmeriCorps. Produced and published at taxpayer expense. 
 You are leaving AmeriCorps.gov
 The website you’re going to is not part of the AmeriCorps domain and may not be under AmeriCorps’ control. Its privacy and security practices and policies may differ from AmeriCorps’. AmeriCorps is not responsible for the link, nor does it endorse the content of the third-party website. Click on the continue button to proceed to the external website; otherwise click cancel to stay on AmeriCorps.gov.
 Cancel Continue