Skip to main content Skip to search


Browse by
                    category
                Browse by
                    bureaus & offices
            About the FCC
          About the FCC
                      About the FCC Overview
                                                      What We Do
                                                      Rulemaking Process
                                                      Leadership
                                                      FCC Initiatives
                                                      Find People
                                                      Organizational Charts
                                                      Advisory Committees
                                                      Jobs and Internships
                                                      Contracting
                                                      Strategic Plans & Budgets
                                                      Contact
                                                                    FY 2025 Congressional Budget Justification
                                                      Privacy Policy
                                                      Accessibility Program
                Proceedings & Actions
          Proceedings & Actions
                      Proceedings and Actions Overview
                                                      Electronic Comment Filing System (ECFS)
                                                      Commission Documents (EDOCS)
                                                      Most Active Proceedings
                                                      Items on Circulation
                                                      Ex-Parte
                                                      Daily Digest
                                                      Mergers & Transactions
                                                      Auctions
                Licensing & Databases
          Licensing & Databases
                      Overview
                                                      About Licensing
                                                      Databases
                                                      Fees
                                                      Forms
                                                      FCC Registration System (CORES)
                                                      System Alerts & Notifications
                                                      ASR
                                                      CDBS
                                                      CEFS
                                                      COALS
                                                      CORES
                                                      CSRS
                                                      DIRS
                                                      EA
                                                      ECFS
                                                      EDOCS
                                                      ELS
                                                      ETFS
                                                      ETRS
                                                      GenMen
                                                      HAM
                                                      KDB
                                                      KIDVID
                                                      LMS
                                                      ICFS
                                                      NORS
                                                      PIF
                                                      PIRATE
                                                      PSIX-ESIX
                                                      RLD
                                                      TCB
                                                      ULS
                                                      URS
                                                      VPD
                Reports & Research
          Reports & Research
                      Reports and Data Overview
                                                      Reports
                                                      Data
                                                      Guides
                                                                    Maps
                                                      Working Papers
                                                      For Developers
                                                                    Fiscal Year 2022-2026 Strategic Plan
                                                      Workload Dashboard
                News & Events
          News & Events
                      News and Events Overview
                                                      Headlines
                                                      Commission Meetings
                                                      Events
                                                      Archived Events
                                                      FCC Podcast
                                                      Notes from the FCC
                                                      FCC Blog
                                                      RSS Feeds & Email Signup
                                                                    April 2024 Open Commission Meeting
                For Consumers
          For Consumers
                      Help Center Overview
                                                                    Consumer Complaint Center
                                                      Disability Rights
                                                      Headlines
                                                      Social Media
                                                                    Robocalls
                                                                    Consumer Complaint Center
              Consumer
                Enforcement
                Media
                Public Safety
                Space
                Wireless
                Wireline
                Offices
    
                  Search
  

  X
  Search Home
              Managing Director

  Vulnerability Disclosure Policy *Federal Communications Commission
March 1, 2021*

**Purpose**

The Federal Communications Commission (FCC) is committed to ensuring the security of the American public by protecting their information. This policy is intended to give security researchers clear guidelines for conducting vulnerability discovery activities and to convey our preferences in how to submit discovered vulnerabilities to us.

This policy describes **what systems and types of research** are covered under this policy, **how to send us** vulnerability reports, and **how long** we ask security researchers to wait before publicly disclosing vulnerabilities.

We encourage you to contact us to report potential vulnerabilities in our systems.

**Scope**

All fcc.gov domains are within scope of the FCC’s vulnerability disclosure program and are authorized for testing. Vulnerabilities found in systems from our vendors fall outside of this policy’s scope and should be reported directly to the vendor according to their disclosure policy (if any). If you aren’t sure whether a system is in scope or not, contact us at NSOC-Monitor@fcc.gov. before starting your research. Though we develop and maintain other internet-accessible systems or services, we ask that active research and testing only be conducted on the systems and services covered by the scope of this document. If there is a particular system not in scope that you think merits testing, please contact us to discuss it first. The scope of this policy will increase over time.

**Policy**

**Authorization**

**If the FCC determines that you made a good faith1 effort to comply with this policy during your security research, we will consider your research to be authorized, we will work with you to understand and resolve potential issues quickly, and the FCC will not recommend or pursue legal action related to your research. Should legal action be initiated by a third party against you for activities that were conducted in accordance with this policy, we will make this authorization known.**

1 “In the context of [the Cybersecurity and Infrastructure Security Agency’s Binding Operational Directive 20-01], “good faith” means security research conducted with the intent to follow an agency’s [Vulnerability Disclosure Policy (VDP)] without any malicious motive; [the FCC] may evaluate an individual’s intent on multiple bases, including by their actions, statements, and the results of their actions. In other words, good faith security research means accessing a computer or software solely for purpose of testing or investigating a security flaw or vulnerability and disclosing those findings in alignment with the VDP. The security researcher’s actions should be consistent with an attempt to improve security and to avoid doing harm, either by unwarranted invasions of privacy or causing damage to property.” Additional information on what is meant by good faith can be found at https://cyber.dhs.gov/bod/20-01/#what-does-the-directive-mean-by-good-f....

**Guidelines**

Under this policy, “research” means activities in which you:

Notify us as soon as possible after you discover a real or potential security issue.
	Make every effort to avoid privacy breaches, degradation of user experience, disruption to production systems, and destruction or manipulation of data. In the event you encounter personally identifiable information during your testing, you will immediately cease testing and notify the FCC.
	Only use exploits to the extent necessary to confirm a vulnerability’s presence. Do not use an exploit to compromise or exfiltrate data, establish command line access and/or persistence, or use the exploit to pivot to other systems.
	Provide us a minimum of 90 day’s to resolve the issue before requesting to publicly disclose the report.
	Do not submit a high volume of low-quality reportsOnce you’ve established that a vulnerability exists or encounter any sensitive data (including personally identifiable information, financial information, or proprietary information or trade secrets of any party), **you must stop your test, notify us immediately, and not disclose this data to anyone else**.

**Test methods**

The following test methods are not authorized:

Network denial of service (DoS or DDoS) tests or other tests that impair access to or damage a system or data (Such as Brute Force Testing).
	Physical testing (e.g. office access, open doors, tailgating), social engineering (e.g. phishing, vishing), or any other non-technical vulnerability testing.**Applicable Laws/Guidance**

Binding Operational Directive (BOD) 20-01, available at: https://cyber.dhs.gov/bod/20-01/.**Information and Assistance**

**Reporting a vulnerability**

Information submitted under this policy will be used for defensive purposes only – to mitigate or remediate vulnerabilities. If your findings include newly discovered vulnerabilities that affect all users of a product or service and not solely the FCC, we may share your report with the Cybersecurity and Infrastructure Security Agency, where it will be handled under their coordinated vulnerability disclosure process.

We accept vulnerability reports through our bugcrowd program (https://bugcrowd.com/fcc-vdp) and questions can be directed to NSOC-Monitor@fcc.gov.. Reports may be submitted anonymously. If you share contact information, we will acknowledge receipt of your report within 5 business days.

**What we would like to see from you**

In order to help us triage and prioritize submissions, we recommend that your reports:

Describe the location the vulnerability was discovered and the potential impact of exploitation.
	Offer a detailed description of the steps needed to reproduce the vulnerability (proof of concept scripts or screenshots are helpful).
	Be in English, if possible.**What you can expect from us**

When you choose to share your contact information with us, we commit to coordinating with you as openly and as quickly as possible.

Within 5 business days, we will acknowledge that your report has been received.
	To the best of our ability, we will confirm the existence of the vulnerability to you and be as transparent as possible about what steps we are taking during the remediation process, including any issues or challenges that may delay resolution.
	We will maintain an open dialogue to discuss issues.**Questions**

Questions regarding this policy may be sent to **NSOC-Monitor@fcc.gov**. We also invite you to contact us with suggestions for improving this policy.

        
        
                  **Bureau/Office:**
  Managing Director
            
                          Tags:
    
      
    FCC Management & PoliciesPolicy
            
                          **Updated:**
                Friday, October 1, 2021
 Text
                  Federal Communications Commission
45 L Street NE
Washington, DC 20554

  Link
        Phone: 1-888-225-5322
              ASL Video Call: 1-844-432-2275
              Fax: 1-866-418-0232
              Contact Us
              Visiting FCC Facilities

          
          Link
        Website Policies & Notices
              Privacy Policy
              FOIA
              No Fear Act Data
              Digital Strategy
              Open Government Directive
              Plain Writing Act
              RSS Feeds & Email Updates
              Accessibility
              Vulnerability Disclosure Policy
              USA.gov

          
          Text
                  CATEGORIES

  Link
        About the FCC
              Proceedings & Actions
              Licensing & Databases
              Reports & Research
              News & Events
              For Consumers

          
          Text
                  BUREAUS & OFFICES

  Link
        Consumer
              Enforcement
              Inspector General
              Media
              Public Safety
              Space
              Wireless
              Wireline
              Offices


          Twitter
        Facebook
        Youtube
        Instagram

          Federal Communications Commission