<!DOCTYPE html>
<html lang="en" dir="ltr" prefix="og: https://ogp.me/ns#">
  <head>
    <meta charset="utf-8" />
<link rel="canonical" href="https://www.justice.gov/jmd/vulnerability-disclosure-policy" />
<link rel="image_src" href="https://www.justice.gov/sites/all/modules/features/doj_sharing/images/doj-seal-fb.jpg" />
<meta name="keywords" content="," />
<meta property="og:type" content="page" />
<meta property="og:url" content="https://www.justice.gov/jmd/vulnerability-disclosure-policy" />
<meta property="og:title" content="Vulnerability Disclosure Policy (VDP)" />
<meta property="og:image" content="https://www.justice.gov/sites/all/modules/features/doj_sharing/images/doj-seal-fb.jpg" />
<meta property="article:published_time" content="2021-03-01T15:38:35-05:00" />
<meta property="article:modified_time" content="2024-04-03T09:43:20-04:00" />
<meta name="twitter:card" content="summary_large_image" />
<meta name="twitter:title" content="Vulnerability Disclosure Policy (VDP)" />
<meta name="twitter:url" content="https://www.justice.gov/jmd/vulnerability-disclosure-policy" />
<meta name="twitter:image" content="https://www.justice.gov/sites/all/modules/features/doj_sharing/images/doj-seal-fb.jpg" />
<meta name="Generator" content="Drupal 9 (https://www.drupal.org)" />
<meta name="MobileOptimized" content="width" />
<meta name="HandheldFriendly" content="true" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<link rel="apple-touch-icon-precomposed" href="https://www.justice.gov/themes/custom/usdoj_uswds/images/touch-icons/apple-touch-icon-precomposed-114x114.png" size="114x114" />
<link rel="apple-touch-icon-precomposed" href="https://www.justice.gov/themes/custom/usdoj_uswds/images/touch-icons/apple-touch-icon-precomposed-144x144.png" size="144x144" />
<link rel="apple-touch-icon-precomposed" href="https://www.justice.gov/themes/custom/usdoj_uswds/images/touch-icons/apple-touch-icon-precomposed-72x72.png" size="72x72" />
<link rel="apple-touch-icon-precomposed" href="https://www.justice.gov/themes/custom/usdoj_uswds/images/touch-icons/apple-touch-icon-precomposed.png" />
<link rel="icon" href="/themes/custom/usdoj_uswds/favicon.ico" type="image/vnd.microsoft.icon" />
<link rel="alternate" hreflang="en" href="https://www.justice.gov/jmd/vulnerability-disclosure-policy" />

      <title> Justice Management Division |  Vulnerability Disclosure Policy (VDP)</title>

      <!-- Import google fonts -->
      <link rel="preconnect" href="https://fonts.googleapis.com">
      <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
      <link href="https://fonts.googleapis.com/css2?family=Source+Serif+Pro:wght@600;700&display=swap" rel="stylesheet">

      <link rel="stylesheet" type="text/css" href="//cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/slick.css"/>

      <link rel="stylesheet" media="all" href="/d9/css/css_DQA3ShU5sn32QqxOErgYX-KON8bi5_HVZyVOltnZax8.css" />
<link rel="stylesheet" media="all" href="/d9/css/css_oxx8k4qiBV2HodsbITOr6v7c3NtoURr75ese5ZzEMAg.css" />

        <script src="https://dap.digitalgov.gov/Universal-Federated-Analytics-Min.js?agency=DOJ&sp=find&yt=true" id="_fed_an_ua_tag" async></script>
<script src="https://siteimproveanalytics.com/js/siteanalyze_8906.js" async></script>

          </head>
        <body class="below-desktop" data-content-type="page">
                    <a href="#main-content" class="usa-sr-only focusable">
            Skip to main content
          </a>
          <div class="usdoj_overlay position-fixed z-100"></div>
          
            <div class="dialog-off-canvas-main-canvas" data-off-canvas-main-canvas>
    
<div class="usa-overlay"></div>

  <header class="usa-header usa-header--extended usa-header--extended-megamenu usdojMobileMenuSlider" id="header" role="banner">

    <section class="usa-banner-wrapper">
      
<div class="usa-banner">
  <div class="usa-accordion">
    <header class="usa-banner__header">
      <div class="usa-banner__inner">
        <div class="grid-col-auto">
          <img class="usa-banner__header-flag" src="/themes/custom/usdoj_uswds/assets/img/us_flag_small.png" alt="U.S. flag">
        </div>
        <div class="grid-col-fill tablet:grid-col-auto">
          <p class="usa-banner__header-text">An official website of the United States government</p>
          <p class="usa-banner__header-action" aria-hidden="true">Here's how you know</p>
        </div>
        <button class="usa-accordion__button usa-banner__button" aria-expanded="false" aria-controls="gov-banner">
          <span class="usa-banner__button-text">Here's how you know</span>
        </button>
      </div>
    </header>
    <div class="usa-banner__content usa-accordion__content" id="gov-banner" hidden="">
      <div class="grid-row grid-gap-lg">
        <div class="usa-banner__guidance tablet:grid-col-6">
          <img class="usa-banner__icon usa-media-block__img" src="/themes/custom/usdoj_uswds/assets/img/icon-dot-gov.svg" alt="Dot gov">
          <div class="usa-media-block__body">
            <p>
              <strong>Official websites use .gov</strong>
              <br>
              A <strong>.gov</strong> website belongs to an official government organization in the United States.
            </p>
          </div>
        </div>
        <div class="usa-banner__guidance tablet:grid-col-6">
          <img class="usa-banner__icon usa-media-block__img" src="/themes/custom/usdoj_uswds/assets/img/icon-https.svg" alt="Https">
          <div class="usa-media-block__body">
            <p>
              <strong>Secure .gov websites use HTTPS</strong>
              <br>
              A <strong>lock</strong> (   <span class="icon-lock">
    <svg xmlns="http://www.w3.org/2000/svg" width="52" height="64" viewBox="0 0 52 64" class="usa-banner__lock-image" role="img" aria-labelledby="banner-lock-title banner-lock-description" focusable="false">
      <title id="banner-lock-title">Lock</title>
      <desc id="banner-lock-description">A locked padlock</desc>
      <path fill="#000000" fill-rule="evenodd" d="M26 0c10.493 0 19 8.507 19 19v9h3a4 4 0 0 1 4 4v28a4 4 0 0 1-4 4H4a4 4 0 0 1-4-4V32a4 4 0 0 1 4-4h3v-9C7 8.507 15.507 0 26 0zm0 8c-5.979 0-10.843 4.77-10.996 10.712L15 19v9h22v-9c0-6.075-4.925-11-11-11z"/>
    </svg>
  </span>
 ) or <strong>https://</strong> means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
            </p>
          </div>
        </div>
      </div>
    </div>
  </div>
</div>

    </section>
            <div>
    
<div id="block-main-navigation-above-header" class="settings-tray-editable block block- block-system block-system-menu-blockmain block-grouped-menu" data-drupal-settingstray="editable">
      <div id="doj-menu" class="usa-prose group-wrapper__content group-wrapper__content__menu">
      <div class="above-header-menu usaDoj-menu">
    <div class="grid-container">
        <div class="grid-row">
            <div class="grid-col-fill position-relative">
                <button class="above-header-menu__btn menu-btn padding-105 bg-primary-darker text-white border-0 display-flex display-flex position-relative z-200" aria-expanded="false" aria-controls="above-header-wrapper">
                <span class="above-header-menu__btn__icon_open">
                    <img src="/themes/custom/usdoj_uswds/images/doj-icon-hamburger-menu.svg" alt="open menu icon">
            </span>
                    <span class="above-header-menu__btn__icon_close display-none">
                                   <img src="/themes/custom/usdoj_uswds/images/doj-icon-hamburger-close.svg"
                                        alt="open menu icon">

            </span>
                    <span class="above-header-menu__btn__icon_text">DOJ Menu</span>
                </button>
                <div id="above-header-wrapper" class="menu-wrapper menu-wrapper__slider position-absolute top-0 left-0" hidden="">
                    <div class="menu_header text-center font-family-heading text-bold">
                        <a href="/" title="U.S. Department of Justice Homepage">
                            <img class="height-4 width-auto"
                                 src="/themes/custom/usdoj_uswds/images/doj-main-seal-logo.svg" alt="">U.S. Department
                            of Justice
                        </a>
                    </div>

                    

                                                                                        
    
                
                                                                                                                                    
                    <ul class="usa-nav__primary usa-accordion menu-above-header margin-0 menu_level__0">

        
        
            
                                        
                            <li class="usa-nav__primary-item">
            
                            <button class="usa-accordion__button usa-nav__link "
                    aria-expanded="false"
                    aria-controls="basic-nav-section-menu-above-header-1">
                    <span>About</span>
                </button>
            
                                                        
    
                
                                                                                                                
                    <ul id="basic-nav-section-menu-above-header-1" class="usa-nav__submenu" hidden="">
                        
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="/ag"  >
                                            <span class="no_menu_link_imaged__title">The Attorney General</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="/agencies/chart/map"  >
                                            <span class="no_menu_link_imaged__title">Organizational Chart</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="/doj/budget-and-performance"  >
                                            <span class="no_menu_link_imaged__title">Budget & Performance</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="https://www.justice.gov/history"  >
                                            <span class="no_menu_link_imaged__title">History</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="/opcl"  >
                                            <span class="no_menu_link_imaged__title">Privacy Program</span>
                                    </a>
                            
                            </li>
            
        
                    </ul>
        
    

            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__primary-item">
            
            
                                                    
                                <a href="https://www.justice.gov/our-work"  class="usa-nav__link" >
                                            <span class="no_menu_link_imaged__title">Our Work</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__primary-item">
            
                            <button class="usa-accordion__button usa-nav__link "
                    aria-expanded="false"
                    aria-controls="basic-nav-section-menu-above-header-3">
                    <span>News</span>
                </button>
            
                                                        
    
                
                                                                                                                                    
                    <ul id="basic-nav-section-menu-above-header-3" class="usa-nav__submenu" hidden="">
                        
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="https://www.justice.gov/news/press-releases"  >
                                            <span class="no_menu_link_imaged__title">Press Releases</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="https://www.justice.gov/news/speeches"  >
                                            <span class="no_menu_link_imaged__title">Speeches</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="https://www.justice.gov/news/videos"  >
                                            <span class="no_menu_link_imaged__title">Videos</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="https://www.justice.gov/news/photo-galleries"  >
                                            <span class="no_menu_link_imaged__title">Photo Galleries</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="https://www.justice.gov/news/blogs"  >
                                            <span class="no_menu_link_imaged__title">Blogs</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="https://www.justice.gov/news/podcasts"  >
                                            <span class="no_menu_link_imaged__title">Podcasts</span>
                                    </a>
                            
                            </li>
            
        
                    </ul>
        
    

            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__primary-item">
            
                            <button class="usa-accordion__button usa-nav__link "
                    aria-expanded="false"
                    aria-controls="basic-nav-section-menu-above-header-4">
                    <span>Resources</span>
                </button>
            
                                                        
    
                
                                                                                                                                    
                    <ul id="basic-nav-section-menu-above-header-4" class="usa-nav__submenu" hidden="">
                        
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="https://www.justice.gov/guidance"  >
                                            <span class="no_menu_link_imaged__title">Guidance Documents</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="https://www.justice.gov/forms"  >
                                            <span class="no_menu_link_imaged__title">Forms</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="https://www.justice.gov/publications"  >
                                            <span class="no_menu_link_imaged__title">Publications</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="/information-victims-large-cases"  >
                                            <span class="no_menu_link_imaged__title">Information for Victims in Large Cases</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="https://www.justice.gov/jm/justice-manual"  >
                                            <span class="no_menu_link_imaged__title">Justice Manual</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="/business"  >
                                            <span class="no_menu_link_imaged__title">Business and Contracts</span>
                                    </a>
                            
                            </li>
            
        
                    </ul>
        
    

            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__primary-item">
            
            
                                                    
                                <a href="https://www.justice.gov/grants"  class="usa-nav__link" >
                                            <span class="no_menu_link_imaged__title">Grants</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__primary-item">
            
                            <button class="usa-accordion__button usa-nav__link "
                    aria-expanded="false"
                    aria-controls="basic-nav-section-menu-above-header-6">
                    <span>Employment</span>
                </button>
            
                                                        
    
                
                                                                                            
                    <ul id="basic-nav-section-menu-above-header-6" class="usa-nav__submenu" hidden="">
                        
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="https://www.justice.gov/careers/why-justice"  >
                                            <span class="no_menu_link_imaged__title">Why Justice ?</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="https://www.justice.gov/careers/benefits"  >
                                            <span class="no_menu_link_imaged__title">Benefits</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="https://www.justice.gov/careers/search-jobs"  >
                                            <span class="no_menu_link_imaged__title">DOJ Vacancies</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="/legal-careers"  >
                                            <span class="no_menu_link_imaged__title">Legal Careers at DOJ</span>
                                    </a>
                            
                            </li>
            
        
                    </ul>
        
    

            
                            </li>
            
        
                    </ul>
        
    

                        

<div class="mobile-utils mobile-utils_lvl1">
  <div class="mobile-utils__inner tablet-lg:display-none">
    <div class="menu--utilities">
      
        <ul class="menu menu--utilities nav">
                                      <li class="first">
                                                            <a href="/agencies/chart/grid" class="first" data-drupal-link-system-path="node/1397441/grid">Our Offices</a>
                      </li>
                                      <li>
                                                            <a href="/action-center/find-help-and-information-crime-victims" data-drupal-link-system-path="node/15401">Find Help</a>
                      </li>
                                      <li class="last">
                                                            <a href="https://www.justice.gov/contact-us" class="last">Contact Us</a>
                      </li>
              </ul>
  

    </div>
  </div>
</div>
                                                  
                </div>
            </div>
        </div>
    </div>
</div>



    </div>
  </div>

  </div>

        
      <div class="region region-header usa-navbar display-block">
    <div class="grid-container">
      <div class="usa-logo site-logo float-left" id="logo">
  <em class="usa-logo__text">
      <a class="logo-img" href="/jmd" accesskey="1" title="Home" aria-label="Home">
        <img src="/d9/2023-05/doj-logo-jmd_1.svg" alt="DOJ JMD Logo (2)" />

      </a>
  </em>
</div>
<div class="display-none tablet-lg:display-block float-right">
    <nav role="navigation" aria-labelledby="block-utilities-menu" id="block-utilities" class="settings-tray-editable" data-drupal-settingstray="editable">
                        
    <h2 class="usa-sr-only" id="block-utilities-menu">Utilities</h2>
    

                
        <ul class="menu menu--utilities nav">
                                      <li class="first">
                                                            <a href="/agencies/chart/grid" class="first" data-drupal-link-system-path="node/1397441/grid">Our Offices</a>
                      </li>
                                      <li>
                                                            <a href="/action-center/find-help-and-information-crime-victims" data-drupal-link-system-path="node/15401">Find Help</a>
                      </li>
                                      <li class="last">
                                                            <a href="https://www.justice.gov/contact-us" class="last">Contact Us</a>
                      </li>
              </ul>
  

        </nav>
    <!-- desktop search -->
    <!-- <section aria-label="Small search component">
        <form class="usa-search usa-search--small" role="search">
            <label class="usa-sr-only" for="search-field-en-small-desktop">Search</label>
            <input
                class="usa-input"
                id="search-field-en-small-desktop"
                type="search"
                name="search"
                placeholder="Search"
            />
            <button class="usa-button" type="submit">
                <img
                    src="/themes/custom/usdoj_uswds/images/doj-icon-header-search.svg"
                    class="usa-search__submit-icon width-3"
                    alt="Search"
                />
            </button>
        </form>
    </section> -->
        <div class="block block- block-usdoj-search block-usdoj-search-block bg-full-width bg-none">
    
        
          <section aria-label="Small search component">
      <form class="usa-search usa-search--small" role="search" accept-charset="UTF-8" action="https://search.justice.gov/search" id="search_form" method="get">
      <label class="usa-sr-only" for="search-field-en-small-desktop">Search</label>
      <div>
          <input name="utf8" type="hidden" value="✓" />
      </div>
      <input id="affiliate" name="affiliate" type="hidden" value="justice-jmd" />
      <input class="usa-input" autocomplete="off" class="usagov-search-autocomplete" id="search-field-en-small-desktop" name="query" type="search" placeholder="Search" />
      <button class="usa-button" type="submit">
        <img src="/themes/custom/usdoj_uswds/images/doj-icon-header-search.svg" class="usa-search__submit-icon width-3" alt="Search" />
      </button>
      </form>
      </section>
      </div>

</div>

    </div>
</div>

      <input type="checkbox" class="display-none" id="mobile-btn"/>
      <label class="hamburger position-relative tablet-lg:position-static tablet-lg:display-block margin-right-2 tablet-lg:margin-x-auto" for="mobile-btn">
        
        <span class="menu-label">
          <span class="menu-label--icons">
            <span class="menu-label--icons__open display-inline-block"><img src="/themes/custom/usdoj_uswds/images/doj-icon-hamburger-menu.svg" alt="open menu icon"></span>
            <span class="menu-label--icons__close display-none"><img src="/themes/custom/usdoj_uswds/images/doj-icon-hamburger-close.svg" alt="close menu icon"></span>
          </span>
          <span class="menu-label--text menu-label--text__open display-inline-block">Menu</span>
          <span class="menu-label--text menu-label--text__close display-none">Close</span>
        </span>
        <nav class="usa-nav position-absolute tablet-lg:position-static right-neg-2 padding-0" role="navigation">
                    <div class="usa-nav__inner">
            
            
            
                              

      
    
                
                                                                                                                                    
                    <ul class="usa-nav__primary usa-accordion  margin-0 menu_level__0">

        
        
            
                                        
                            <li class="usa-nav__primary-item">
            
                            <button class="usa-accordion__button usa-nav__link "
                    aria-expanded="false"
                    aria-controls="basic-nav-section-_-1">
                    <span>About</span>
                </button>
            
                                                        
    
                
                                                                        
                    <div id="basic-nav-section-_-1" class="usa-nav__submenu menu_level__1" hidden="">
            <div class="grid-row grid-gap-4">
            <div class="tablet-lg:grid-col-fill non_imaged_links__container">
                          <div class="tablet-lg:grid-col-fill individual_menu_level__1">
                <div class="usa-nav__submenu-item no_menu_link_imaged">
                  <a  href="/jmd/about-justice-management-division">
                    <span class="no_menu_link_imaged__title">About</span>
                  </a>
                </div>
              </div>
                                        </div>

        
        
            
                                        
                            <div class="tablet-lg:grid-col-fill individual_menu_level__1">

            
            
                                                                        <div class="usa-nav__submenu-item no_menu_link_imaged">
                
                                <a href="/jmd/about-division/map"  >
                                            <span class="no_menu_link_imaged__title">Organizational Chart</span>
                                    </a>
                                    </div>
                            
                            </div>
            
        
            
                                        
                            <div class="tablet-lg:grid-col-fill individual_menu_level__1">

            
            
                                                                        <div class="usa-nav__submenu-item no_menu_link_imaged">
                
                                <a href="/jmd/jmd-staff-websites"  >
                                            <span class="no_menu_link_imaged__title">JMD Staff Websites</span>
                                    </a>
                                    </div>
                            
                            </div>
            
        
            
                                        
                            <div class="tablet-lg:grid-col-fill individual_menu_level__1">

            
            
                                                                        <div class="usa-nav__submenu-item no_menu_link_imaged">
                
                                <a href="/jmd/diversity-equity-inclusion-and-accessibility-deia"  >
                                            <span class="no_menu_link_imaged__title">Diversity, Equity, Inclusion, and Accessibility (DEIA)</span>
                                    </a>
                                    </div>
                            
                            </div>
            
        
                    </div>
            </div>
        
    

            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__primary-item">
            
            
                                                    
                                <a href="/jmd/jmd-leadership"  class="usa-nav__link" >
                                            <span class="no_menu_link_imaged__title">Leadership</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__primary-item">
            
            
                                                    
                                <a href="/jmd/services"  class="usa-nav__link" >
                                            <span class="no_menu_link_imaged__title">Services</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__primary-item">
            
            
                                                    
                                <a href="/jmd/publications-and-resources"  class="usa-nav__link" >
                                            <span class="no_menu_link_imaged__title">Publications & Resources</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__primary-item">
            
            
                                                    
                                <a href="/jmd/jmd-foia"  class="usa-nav__link" >
                                            <span class="no_menu_link_imaged__title">FOIA</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__primary-item">
            
            
                                                    
                                <a href="/jmd/contact-division"  class="usa-nav__link" >
                                            <span class="no_menu_link_imaged__title">Contact</span>
                                    </a>
                            
                            </li>
            
        
                    </ul>
        
    



<div class="mobile-utils mobile-utils_lvl1">
  <div class="mobile-utils__inner tablet-lg:display-none">
    <div class="menu--utilities">
      
        <ul class="menu menu--utilities nav">
                                      <li class="first">
                                                            <a href="/agencies/chart/grid" class="first" data-drupal-link-system-path="node/1397441/grid">Our Offices</a>
                      </li>
                                      <li>
                                                            <a href="/action-center/find-help-and-information-crime-victims" data-drupal-link-system-path="node/15401">Find Help</a>
                      </li>
                                      <li class="last">
                                                            <a href="https://www.justice.gov/contact-us" class="last">Contact Us</a>
                      </li>
              </ul>
  

    </div>
  </div>
</div>

    
  <div class="nested-primary-menu no-overlay tablet-lg:display-none">
    <div class="grid-container padding-x-0">
      <div class="grid-row">
        <div class="grid-col-fill position-relative">
          <button class="nested-primary-menu__button menu-btn padding-y-105 text-white border-0 display-flex position-relative z-200" aria-expanded="false" aria-controls="nested-primary-wrapper">
            <div class="nested-primary-menu__button__label">Main Menu</div>
            <div class="nested-primary-menu__button__siteName display-flex">
              <div class="nested-primary-menu__button__seal">
                <img class="height-4 width-auto"
                     src="/themes/custom/usdoj_uswds/images/doj-main-seal-logo.svg" alt="United States Department of Justice Seal" aria-hidden="true"/>
              </div>
              <div class="nested-primary-menu__button__dojText font-family-heading">U.S. Department of Justice</div>
              <div class="nested-primary-menu__button__expandIndicator">
                <span class="nested-primary-menu__button__icon_open">
                  <img src="/themes/custom/usdoj_uswds/images/expand_more-rounded--white.svg"
                         alt="close menu icon" aria-hidden="true">
                </span>
                <span class="nested-primary-menu__button__icon_close display-none">
                  <img src="/themes/custom/usdoj_uswds/images/expand_less-rounded--white.svg" alt="expand menu icon" aria-hidden="true">
                </span>
              </div>
            </div>
          </button>
          <div id="nested-primary-wrapper" class="menu-wrapper no-overlay menu-wrapper__slider display-none">
                
    
                
                                                                                                                                    
                    <ul class="usa-nav__primary usa-accordion nested-primary-menu-items margin-0 menu_level__0">

        
        
            
                                        
                            <li class="usa-nav__primary-item">
            
                            <button class="usa-accordion__button usa-nav__link "
                    aria-expanded="false"
                    aria-controls="basic-nav-section-nested-primary-menu-items-1">
                    <span>About</span>
                </button>
            
                                                        
    
                
                                                                                                                
                    <ul id="basic-nav-section-nested-primary-menu-items-1" class="usa-nav__submenu" hidden="">
                                    <li class="usa-nav__submenu-item">
                         title="About"
                        <a  title="About" href="/about">
                            <span><strong>About</strong></span>
                        </a>
                    </li>
                        
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="/ag"  >
                                            <span class="no_menu_link_imaged__title">The Attorney General</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="/agencies/chart/map"  >
                                            <span class="no_menu_link_imaged__title">Organizational Chart</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="/doj/budget-and-performance"  >
                                            <span class="no_menu_link_imaged__title">Budget & Performance</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="https://www.justice.gov/history"  >
                                            <span class="no_menu_link_imaged__title">History</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="/opcl"  >
                                            <span class="no_menu_link_imaged__title">Privacy Program</span>
                                    </a>
                            
                            </li>
            
        
                    </ul>
        
    

            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__primary-item">
            
            
                                                    
                                <a href="https://www.justice.gov/our-work"  class="usa-nav__link" >
                                            <span class="no_menu_link_imaged__title">Our Work</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__primary-item">
            
                            <button class="usa-accordion__button usa-nav__link "
                    aria-expanded="false"
                    aria-controls="basic-nav-section-nested-primary-menu-items-3">
                    <span>News</span>
                </button>
            
                                                        
    
                
                                                                                                                                    
                    <ul id="basic-nav-section-nested-primary-menu-items-3" class="usa-nav__submenu" hidden="">
                                    <li class="usa-nav__submenu-item">
                         title="News"
                        <a  title="News" href="https://www.justice.gov/news">
                            <span><strong>News</strong></span>
                        </a>
                    </li>
                        
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="https://www.justice.gov/news/press-releases"  >
                                            <span class="no_menu_link_imaged__title">Press Releases</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="https://www.justice.gov/news/speeches"  >
                                            <span class="no_menu_link_imaged__title">Speeches</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="https://www.justice.gov/news/videos"  >
                                            <span class="no_menu_link_imaged__title">Videos</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="https://www.justice.gov/news/photo-galleries"  >
                                            <span class="no_menu_link_imaged__title">Photo Galleries</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="https://www.justice.gov/news/blogs"  >
                                            <span class="no_menu_link_imaged__title">Blogs</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="https://www.justice.gov/news/podcasts"  >
                                            <span class="no_menu_link_imaged__title">Podcasts</span>
                                    </a>
                            
                            </li>
            
        
                    </ul>
        
    

            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__primary-item">
            
                            <button class="usa-accordion__button usa-nav__link "
                    aria-expanded="false"
                    aria-controls="basic-nav-section-nested-primary-menu-items-4">
                    <span>Resources</span>
                </button>
            
                                                        
    
                
                                                                                                                                    
                    <ul id="basic-nav-section-nested-primary-menu-items-4" class="usa-nav__submenu" hidden="">
                                    <li class="usa-nav__submenu-item">
                         title="Guidance & Resources"
                        <a  title="Guidance & Resources" href="/resources">
                            <span><strong>Resources</strong></span>
                        </a>
                    </li>
                        
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="https://www.justice.gov/guidance"  >
                                            <span class="no_menu_link_imaged__title">Guidance Documents</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="https://www.justice.gov/forms"  >
                                            <span class="no_menu_link_imaged__title">Forms</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="https://www.justice.gov/publications"  >
                                            <span class="no_menu_link_imaged__title">Publications</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="/information-victims-large-cases"  >
                                            <span class="no_menu_link_imaged__title">Information for Victims in Large Cases</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="https://www.justice.gov/jm/justice-manual"  >
                                            <span class="no_menu_link_imaged__title">Justice Manual</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="/business"  >
                                            <span class="no_menu_link_imaged__title">Business and Contracts</span>
                                    </a>
                            
                            </li>
            
        
                    </ul>
        
    

            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__primary-item">
            
            
                                                    
                                <a href="https://www.justice.gov/grants"  class="usa-nav__link" >
                                            <span class="no_menu_link_imaged__title">Grants</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__primary-item">
            
                            <button class="usa-accordion__button usa-nav__link "
                    aria-expanded="false"
                    aria-controls="basic-nav-section-nested-primary-menu-items-6">
                    <span>Employment</span>
                </button>
            
                                                        
    
                
                                                                                            
                    <ul id="basic-nav-section-nested-primary-menu-items-6" class="usa-nav__submenu" hidden="">
                                    <li class="usa-nav__submenu-item">
                        
                        <a  href="https://www.justice.gov/careers">
                            <span><strong>Employment</strong></span>
                        </a>
                    </li>
                        
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="https://www.justice.gov/careers/why-justice"  >
                                            <span class="no_menu_link_imaged__title">Why Justice ?</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="https://www.justice.gov/careers/benefits"  >
                                            <span class="no_menu_link_imaged__title">Benefits</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="https://www.justice.gov/careers/search-jobs"  >
                                            <span class="no_menu_link_imaged__title">DOJ Vacancies</span>
                                    </a>
                            
                            </li>
            
        
            
                                        
                            <li class="usa-nav__submenu-item ">
            
            
                                                    
                                <a href="/legal-careers"  >
                                            <span class="no_menu_link_imaged__title">Legal Careers at DOJ</span>
                                    </a>
                            
                            </li>
            
        
                    </ul>
        
    

            
                            </li>
            
        
                    </ul>
        
    


            <div class="mobile-utils nested-mobile-utils mobile-utils_lvl2">
              <div class="mobile-utils__inner">
                <div class="menu--utilities">
                  
        <ul class="menu menu--utilities nav">
                                      <li class="first">
                                                            <a href="/agencies/chart/grid" class="first" data-drupal-link-system-path="node/1397441/grid">Our Offices</a>
                      </li>
                                      <li>
                                                            <a href="/action-center/find-help-and-information-crime-victims" data-drupal-link-system-path="node/15401">Find Help</a>
                      </li>
                                      <li class="last">
                                                            <a href="https://www.justice.gov/contact-us" class="last">Contact Us</a>
                      </li>
              </ul>
  

                </div>
              </div>
            </div>
          </div>
        </div>
      </div>
    </div>
  </div>




              
              
              
                      </div>
                  </nav>
      </label>

      <!-- mobile search -->
      <div class="tablet-lg:display-none">
        <section aria-label="Small search component">
          <form class="usa-search usa-search--mobile"
            role="search"
            accept-charset="UTF-8"
            action="https://search.justice.gov/search"
            method="get"
            data-once="form-updated"
            data-drupal-form-fields="affiliate-mobile,search-field-en-small"
          >
            <div class="width-full padding-2">
              <label class="usa-sr-only" for="search-field-en-small"> Search </label>
              <input
                id="affiliate-mobile"
                name="affiliate"
                type="hidden"
                value="justice-jmd"
              />
              <input
                class="usa-input"
                id="search-field-en-small"
                type="search"
                name="query"
                placeholder="Search"
              />
              <button class="usa-button" type="submit">
                <img
                  src="/themes/custom/usdoj_uswds/images/doj-icon-header-search.svg"
                  alt="Search"
                />
              </button>
            </div>
          </form>
        </section>
      </div>

      
  </header>


  <main class="main-content usa-layout-docs usa-section position-relative " role="main">
    <div class="usdoj_overlay below-header"></div>

    <a id="main-content" tabindex="-1"></a>
    <div class="grid-container">

                        <div class="breadcrumb-wrapper display-none tablet-lg:display-block">
            <div class="grid-row">
                <div>
        <div id="block-breadcrumbs" class="settings-tray-editable block block- block-system block-system-breadcrumb-block bg-full-width" data-drupal-settingstray="editable">
    
        
              <nav role="navigation" aria-labelledby="system-breadcrumb">
        <h2 id="system-breadcrumb" class="usa-sr-only">Breadcrumb</h2>
        <ol class="usa-breadcrumb__list">
                            <li class="usa-breadcrumb__list-item">
                                            <a href="/" class="usa-breadcrumb__link">Justice.gov</a>
                                    </li>
                            <li class="usa-breadcrumb__list-item">
                                            <a href="/jmd" class="usa-breadcrumb__link">Justice Management Division</a>
                                    </li>
                            <li class="usa-breadcrumb__list-item">
                                            Vulnerability Disclosure Policy (VDP)
                                    </li>
                    </ol>
    </nav>

      </div>

  </div>

            </div>
          </div>
        
                  <div class="">
            
          </div>
        
                      
      <div class="grid-row grid-gap a11y-natural-flow">
        
                <div
          class="usa-layout-docs__main tablet-lg:grid-col-fill">
              <div data-drupal-messages-fallback class="hidden"></div>

<article role="article" class="content-type-page">
  
    
  
  <div>
      <div class="layout layout--onecol">
    <div >
      
    </div>
  </div>

      <div class="layout layout--onecol ">
      <div class="layout__region">
         
  <div  class="block block- block-layout-builder block-field-blocknodepagetitle bg-full-width block-field-title">
            <h1 class="block-heading">
<span class="field-formatter--string">Vulnerability Disclosure Policy (VDP)</span>
</h1>
  </div>

    <div class="node-share">

<div>

    <div class="usdoj-sharing">
      <button type="button" class="usdoj-sharing-toggle" tabindex="0" aria-label="Share" aria-expanded="false" aria-controls="sharing-links"><span class="toggle-text">Share</span><span class="toggle-icon"><img src="/themes/custom/usdoj_uswds/assets/img/angle-arrow-right-white.svg" alt="right caret" width="6" height="6" aria-hidden="true" /></span></button>

        <ul style="display:none;" id="sharing-links">
            <li>
                <a href="http://www.facebook.com/sharer/sharer.php?u=https://www.justice.gov/jmd/vulnerability-disclosure-policy" target="_blank" title="Share on Facebook" data-event-label="Share on Facebook">Facebook</a>
            </li>
            <li>
                <a href="http://twitter.com/intent/tweet?url=https://www.justice.gov/jmd/vulnerability-disclosure-policy&text=Vulnerability Disclosure Policy (VDP)" target="_blank" title="Share on X" data-event-label="Share on X">X</a>
            </li>
            <li>
                <a href="http://www.linkedin.com/shareArticle?mini=true&url=https://www.justice.gov/jmd/vulnerability-disclosure-policy&title=Vulnerability Disclosure Policy (VDP)" target="_blank" title="Share on LinkedIn" data-event-label="Share on LinkedIn">LinkedIn</a>
            </li>
            <li>
                <a href="mailto:?body=https://www.justice.gov/jmd/vulnerability-disclosure-policy&subject=Vulnerability Disclosure Policy (VDP)" title="Email" data-event-label="Email">Email</a>
            </li>
        </ul>
    </div>

</div>
</div>
    <div class="node-language-switcher"></div>
    <div class="block block- block-layout-builder block-field-blocknodepagefield-body bg-full-width bg-none">
    
        
          




            <div>
        <div class="field-formatter--text-default field-text-format--wysiwyg text-formatted field_body"><ul class="doj-stars">
<li>Purpose </li>
<li>Authorized Activities </li>
<li>Overview </li>
<li>Scope of Policy </li>
<li>Reporting a Vulnerability</li>
<li>What You Can Expect from Us </li>
<li>Activities Outside the Scope of this Policy</li>
</ul>

<h2><a name="Purpose"></a>Purpose</h2>

<p>The Department of Justice (DOJ) is committed to ensuring the security of the American public by safeguarding their digital information. This Vulnerability Disclosure Policy (VDP) provides guidelines for the cybersecurity research community and members of the general public (hereafter referred to as researchers) on conducting good faith vulnerability discovery activities directed at public facing DOJ websites and services.  This VDP also instructs researchers on how to submit discovered vulnerabilities<a name="_ftnref1"></a>[1] to the DOJ’s Office of the Chief Information Officer (OCIO), within the Justice Management Division.</p>

<h2><a name="Activities"></a>Authorized Activities</h2>

<p>If a researcher complies with this policy in conducting vulnerability discovery activities, DOJ OCIO will consider those activities to be authorized.</p>

<h2><a name="Overview"></a>Overview</h2>

<p>Providing information and resources to the public and the law enforcement community constitutes a significant part of DOJ’s mission.  Many of those interactions with the public are now conducted online.  As such, DOJ’s information systems<a name="_ftnref2"></a>[2] play a critical role in supporting the Department and its component staffs as they execute their missions and safeguard American citizens.  Maintaining the security of DOJ’s systems and networks is the mission of the DOJ OCIO.  </p>

<p>DOJ OCIO recognizes that the cybersecurity research community regularly makes valuable contributions to the cybersecurity of individual organizations and the broader Internet.  DOJ OCIO recognizes that fostering a positive relationship with this community can help improve the Department’s own security.</p>

<p>Vulnerabilities submitted to DOJ OCIO under this policy will be used for defensive purposes – to mitigate or remediate vulnerabilities in our networks and services, or those of our vendors.</p>

<p>Researchers must review, understand, and abide by the following terms and conditions before conducting any research or testing on DOJ networks and before submitting a report. </p>

<p><b>General Guidelines</b></p>

<p>As described in more detail below, to be considered authorized activities under this policy, researchers must:</p>

<ul>
<li>Notify DOJ OCIO within 72 hours of discovering any real or potential security vulnerabilities.</li>
<li>Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data.</li>
<li>Only conduct testing activities to the extent necessary to confirm a vulnerability’s presence.
<ul>
<li>Do not use any exploit to compromise or exfiltrate data; open, take, or delete files; establish command line access and/or persistence; or pivot to other systems.</li>
<li>Do not escalate privileges or attempt to move laterally within the network.</li>
<li>Do not disrupt access to DOJ services or introduce any malware in the course of testing.</li>
</ul>
</li>
<li>Do not publicly disclose reported vulnerabilities without prior coordination with DOJ OCIO.</li>
<li>Do not submit a high volume of low-quality reports.</li>
</ul>

<p>Once a researcher establishes that a vulnerability exists, or encounters any sensitive data (including personally identifiable information, financial information, or the proprietary information or trade secrets of any party), they must <b>stop testing, notify DOJ OCIO immediately through our vulnerability submission process, and not disclose this data to anyone else.</b></p>

<p><b>Test Methods</b></p>

<p>DOJ OCIO will deal in good faith with researchers who discover, test, and submit vulnerabilities or indicators of vulnerabilities in accordance with the following guidelines:</p>

<ul>
<li>Testing activities are limited exclusively to 
<ul>
<li>(1) Testing to detect a vulnerability or identify an indicator related to a vulnerability;<a name="_ftnref3"></a>[3] or</li>
<li>(2) Sharing information with, or receiving information from, DOJ OCIO about a vulnerability or an indicator related to a vulnerability.</li>
</ul>
</li>
<li>Researchers may not harm any DOJ system or data on a DOJ system or exploit any potential vulnerabilities beyond the minimal amount of testing required to prove that a vulnerability exists or to identify an indicator related to a vulnerability.</li>
<li>Researchers must not establish command line access and/or persistence; pivot to other systems; escalate privileges; attempt to move laterally within the network; disrupt access to DOJ services; or introduce any malware in the course of testing.</li>
<li>Researchers must avoid intentionally accessing the content of any communications, data, or information transiting or stored on any DOJ information system – except to the extent that the information is directly related to a vulnerability and the access is necessary to prove that the vulnerability exists.</li>
<li>Researchers must not intentionally exfiltrate or copy DOJ data, or open, take, or delete files. Should researchers obtain DOJ data during their research, they must coordinate with DOJ OCIO to ensure that data is appropriately destroyed upon confirmation that the vulnerability is remediated.</li>
<li>Researchers may not intentionally compromise the privacy or safety of DOJ personnel (e.g. employees, contractors, or parties to ongoing investigations) or any third parties.</li>
<li>Researchers may not intentionally compromise the intellectual property or other commercial or financial interests of any DOJ personnel or entities or any third parties through their research.</li>
<li>Researchers may not publicly disclose any details of the vulnerability, indicator of vulnerability, or the content of information rendered available by a vulnerability, until that vulnerability is remediated and they receive explicit written authorization from DOJ OCIO.</li>
<li>Researchers may not conduct denial-of-service (DoS or DDoS) tests or other tests that impair access to or damage a system or data.</li>
<li>Researchers may not conduct physical testing or social engineering, including spear phishing, of DOJ personnel or contractors.</li>
<li>Researchers may not intentionally submit a high-volume of low-quality, unsubstantiated, or false-positive reports.<br />
If at any point researchers are uncertain whether to continue testing, researchers must engage with DOJ OCIO at the email address provided below before conducting any further testing.</li>
</ul>

<h2><a name="Scope"></a>Scope of Policy</h2>

<p>This policy applies to all DOJ-managed systems and services that are accessible from the Internet. This includes the registered domain name - DOJ.gov. If a researcher is unsure whether a system is in scope or not, contact DOJ at <a href="mailto:Responsible_Disclosure@usdoj.gov" rel="nofollow">Responsible_Disclosure@usdoj.gov</a> before starting any testing (or at the security contact for the system’s domain name listed in the <a href="https://domains.dotgov.gov/dotgov-web/registration/whois.xhtml" rel="nofollow">.gov WHOIS</a>).</p>

<h2><a name="Vulnerability"></a>Reporting a Vulnerability</h2>

<p>If a vulnerability is discovered, researchers must provide a detailed summary of the vulnerability, including the following:</p>

<ul>
<li>description of the vulnerability and its potential impact;</li>
<li>product, version, and configuration of any software or hardware potentially impacted;</li>
<li>step-by-step instructions to reproduce the issue;</li>
<li>proof-of-concept; and</li>
<li>suggested mitigation or remediation actions, as appropriate. </li>
</ul>

<p>DOJ OCIO will accept vulnerability disclosure reports through the DOJ VDP Reporting Portal or by email. When submitting sensitive material, DOJ OCIO recommends encrypting the data.</p>

<p>By submitting a report through the DOJ VDP Portal or communicating with DOJ OCIO at Responsible_Disclosure@usdoj.gov, DOJ OCIO will presume that the submitter read, understands, and agrees to the guidelines described in this policy, and consents to having any subsequent communications with DOJ stored on a U.S. Government information system.  Personal data submitted in a vulnerability disclosure report will not be retained by DOJ OCIO, other than contact information that will only be retained in order to coordinate with the researcher.</p>

<p><b><i>By submitting a report or communicating with DOJ OCIO at Responsible_Disclosure@usdoj.gov, DOJ OCIO will presume that the submitter read, understands, and agrees to the guidelines described in this policy, and consents to having any subsequent communications with DOJ stored on a U.S. Government information system.  </i></b>Personal data submitted in a vulnerability disclosure report will not be retained by DOJ OCIO, other than contact information that will only be retained in order to coordinate with the researcher.</p>

<p>If a researcher discovers a zero-day or any new vulnerability that may affect all users of a product or service and not solely the DOJ, DOJ OCIO may share a vulnerability disclosure report with the Cybersecurity and Infrastructure Security Agency, where it will be handled under their coordinated vulnerability disclosure process. We will not share your name or contact information without your express permission.</p>

<h2><a name="Expect"></a>What You Can Expect From Us</h2>

<p>DOJ OCIO will take every disclosure report seriously and, to the extent it deems appropriate, investigate every report to validate the vulnerability, prioritize the risk, and ensure that appropriate steps are taken to mitigate risk and remediate reported vulnerabilities.</p>

<p>DOJ OCIO remains committed to coordinating with the security research community as openly and quickly as possible. This includes:</p>

<ul>
<li>Acknowledging receipt of each vulnerability report within three (3) business days. DOJ OCIO’s security team or its partners will investigate each report, and may contact the researcher for further information.</li>
<li>Confirming the existence of the vulnerability to the researcher to the best of our ability and informing the researcher of any issues or challenges that may delay resolution.  If necessary, DOJ OCIO or its partners may coordinate with the researcher for additional information as we work to remediate a vulnerability. </li>
<li>Maintaining an open dialogue with individual researchers to discuss issues.</li>
<li>If researchers conduct vulnerability disclosure activities in accordance with the restrictions and guidelines set forth in this policy, (1) DOJ OCIO will not initiate or recommend any law enforcement or civil actions related to such activities, and (2) in the event of any law enforcement or civil action brought in connection with research activities, DOJ OCIO will take steps to make known that your activities were conducted pursuant to and in compliance with this policy. </li>
</ul>

<h2><a name="outside"></a>Activities Outside the Scope of this Policy</h2>

<p>DOJ does not authorize, permit, or otherwise allow (expressly or impliedly) any person, including any individual, group of individuals, consortium, partnership, or any other business or legal entity, to engage in any security research or vulnerability or threat disclosure activity on or affecting DOJ systems that is inconsistent with this policy or the law. If you engage in any activities that are inconsistent with this policy or other applicable law, you may be subject to criminal and/or civil liabilities.<br />
<br />
To the extent that any security research or vulnerability disclosure activity involves the networks, systems, information, applications, products, or services of a non-DOJ entity (e.g., other Federal departments or agencies; State, local, or Tribal governments; private sector companies or persons; employees or personnel of any such entities; or any other such third party), those third parties may independently determine whether to pursue legal action or remedies related to such activities.<br />
<br />
This policy does not in any way limit the authority of the United States Attorneys or other components of the DOJ to pursue legal action.  Nor will actions taken in accordance with this policy shield an individual from prosecution for any previous or future violations of the law.</p>

<p><b>Modification or Termination of this Policy</b><br />
DOJ may modify the terms of this policy or terminate the policy at any time.</p>

<p><b>Questions</b></p>

<p>Questions regarding this policy may be sent to Responsible_Disclosure@usdoj.gov. We also invite you to contact us with suggestions for improving this policy.</p>

<div>
<hr align="left" noshade="noshade" size="1" width="33%" /></div>

<p><a name="_ftn1"></a>[1] Per M-20-32, and consistent with 6 U.S.C. 1501(17), vulnerabilities described by this policy may be considered “security vulnerabilities” and are defined as a “[w]eakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source.”</p>

<p><a name="_ftn2"></a>[2] See definition in 6 U.S.C. 1501(9).</p>

<p><a name="_ftn3"></a>[3] These activities, when undertaken consistent with the terms of this policy, constitute “defensive measures” as defined by 6 U.S.C. 1501(7))</p>
</div>
      </div>
      
  <div class="node-updated-date margin-top-2">Updated April 3, 2024</div>



      </div>

      </div>
    </div>
    <div class="layout layout--onecol">
    <div >
      
    </div>
  </div>

  </div>

</article>


          </div>        
              </div>

            <div class="grid-row grid-gap">
                  <div class="post-content-region">
            
          </div>
              </div>
          </div>
  </main>

  <footer class="usa-footer usa-footer--slim" role="contentinfo">

          <div class="usa-footer__primary-section">

        <div class="usa-footer__primary-content">

                    <div class="grid-container">
            <div class="grid-row grid-gap">
              
              
              
                          </div>
          </div>
          

            <div class="grid-container">
              <div class="blocks-wrapper">


                
                                <div>
                  <div id="block-footeraddress"
                        class="footer-address-block contextual-region block block-general block-block-content bg-full-width">
                    <div>
                      <div class="body">
                        <ul class="usa-icon-list">
                          <li class="usa-icon-list__item">
                            <div class="usa-icon-list__icon">
                              <img alt="envelope icon"
                                    src="/themes/custom/usdoj_uswds/images/doj-header-footer-icons/doj-icon-footer-mail.svg">
                            </div>
                            <div class="usa-icon-list__content">
                              <p><strong>U.S. Department of Justice<br />
Justice Management Division</strong><br />
950 Pennsylvania Avenue NW<br />
Room 1111<br />
Washington DC 20530</p>

                            </div>
                          </li>
                        </ul>
                      </div>
                    </div>
                  </div>

                  <div id="block-footercontact"
                        class="footer-contact-block block block-general block-block-content bg-full-width">
                    <div>
                      <div class="body">
                        <ul class="usa-icon-list">
                          <li class="usa-icon-list__item">
                            <div class="usa-icon-list__icon">
                              <img alt="smartphone icon"
                                    src="/themes/custom/usdoj_uswds/images/doj-header-footer-icons/doj-icon-footer-phone.svg">
                            </div>
                            <div class="usa-icon-list__content">
                              <p>Employment Verification Information<br />
1-800-367-2884<br />
Agency Code 10563</p>

<p>JMD Human Resources<br />
202-514-4350</p>

                            </div>
                          </li>
                        </ul>
                      </div>
                    </div>
                  </div>

                  <div id="block-footersocial"
                        class="footer-social-block block block-general block-block-content bg-full-width">
                    <div class="body">
                      <ul class="usa-icon-list">
                        <li class="usa-icon-list__item">
                            <div class="usa-icon-list__icon">
                              <img alt="smartphone icon"
                                    src="/themes/custom/usdoj_uswds/images/doj-header-footer-icons/doj-icon-footer-smartphone.svg">
                            </div>
                          <div class="usa-icon-list__content">
                                                          <p>Signup for Email Updates<br />
Social Media</p>

                                                                                      <ul class="inline-list">
                                                                  <li>
                                    <a href="http://www.twitter.com/TheJusticeDept" target="_blank">
                                      <span class="invisible">twitter</span>
                                      <img src="/themes/custom/usdoj_uswds/images/doj-header-footer-icons/doj-icon-footer-twitter.svg" class="social-icon" alt="twitter icon" />
                                    </a>
                                  </li>
                                                                  <li>
                                    <a href="https://www.facebook.com/DOJ" target="_blank">
                                      <span class="invisible">facebook</span>
                                      <img src="/themes/custom/usdoj_uswds/images/doj-header-footer-icons/doj-icon-footer-facebook.svg" class="social-icon" alt="facebook icon" />
                                    </a>
                                  </li>
                                                                  <li>
                                    <a href="http://www.youtube.com/TheJusticeDepartment" target="_blank">
                                      <span class="invisible">youtube</span>
                                      <img src="/themes/custom/usdoj_uswds/images/doj-header-footer-icons/doj-icon-footer-youtube.svg" class="social-icon" alt="youtube icon" />
                                    </a>
                                  </li>
                                                                  <li>
                                    <a href="https://www.instagram.com/thejusticedept/" target="_blank">
                                      <span class="invisible">instagram</span>
                                      <img src="/themes/custom/usdoj_uswds/images/doj-header-footer-icons/doj-icon-footer-instagram.svg" class="social-icon" alt="instagram icon" />
                                    </a>
                                  </li>
                                                                  <li>
                                    <a href="https://www.linkedin.com/company/usdoj/mycompany/" target="_blank">
                                      <span class="invisible">linkedin</span>
                                      <img src="/themes/custom/usdoj_uswds/images/doj-header-footer-icons/doj-icon-footer-linkedin.svg" class="social-icon" alt="linkedin icon" />
                                    </a>
                                  </li>
                                                              </ul>
                                                      </div>
                        </li>
                      </ul>
                    </div>
                  </div>
                </div
              </div>
                          </div>

        </div>
      </div>
    
          <div class="usa-footer__secondary-section">
        <div class="grid-container position-relative">
                      <p class="text-center margin-bottom-5"><img alt="U.S. Department of Justice logo"
              src="/themes/custom/usdoj_uswds/images/doj-main-header-logo.svg"
              width="275"></p>
          
          <div class="grid-row grid-gap">
            
                      <div class="grid-container">
              <div class="blocks-wrapper">
                  <div>
    


<div id="block-footercolumn1" class="footer-column1-block settings-tray-editable block block-general block-block-content block-block-content23eb015b-361f-48b2-acb2-736a6e3b52b2 bg-full-width bg-none block_full_width" data-drupal-settingstray="editable">

  
    
      <div class="block-content">
      <div class="block-general__innerWrapper">
                          <div class="block-body">
              
                  <div>
        <div class="field-formatter--text-default field-text-format--wysiwyg text-formatted body"><ul class="tall"><li><a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="fc68a188-2103-43c6-8f2e-5e3d8fa0f9a0" href="/about" title="About DOJ">About</a></li>
<li><a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="72794f66-2679-4437-b98e-e5c7ce71b523" href="/archives/doj-archive" title="Department of Justice Archive">Archives</a></li>
<li><a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="cfb20624-fa15-4794-aa4c-c977e6a1a5bf" href="/oip" title="Office of Information Policy">FOIA</a></li>
<!--<li>Sitemap</li>--></ul></div>
      </div>
            
          </div>
              </div>
    </div>
  </div>



<div id="block-footercolumn2" class="footer-column2-block settings-tray-editable block block-general block-block-content block-block-contentbf3c4da1-c57a-4719-9288-765110cf7470 bg-full-width bg-none block_full_width" data-drupal-settingstray="editable">

  
    
      <div class="block-content">
      <div class="block-general__innerWrapper">
                          <div class="block-body">
              
                  <div>
        <div class="field-formatter--text-default field-text-format--wysiwyg text-formatted body"><ul class="tall"><li><a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="9086ca9e-6614-4358-91bd-2128cee40fc1" href="/accessibility/accessibility-statement" title="Accessibility Statement">Accessibility</a></li>
<li><a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="5fea8833-c4ce-4ba1-a4de-a61e8924916f" href="/legalpolicies" title="Legal Policies and Disclaimers">Legal Policies & Disclaimers</a></li>
<li>Privacy</li>
<li><a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="ffa83eba-8394-4044-b2de-ec7f8f4b3762" href="/employees" title="For Employees">For Employees</a></li>
</ul></div>
      </div>
            
          </div>
              </div>
    </div>
  </div>



<div id="block-footercolumn3" class="footer-column3-block settings-tray-editable block block-general block-block-content block-block-contenta666f6e1-ef43-49ba-8781-3a3de47b3a58 bg-full-width bg-none block_full_width" data-drupal-settingstray="editable">

  
    
      <div class="block-content">
      <div class="block-general__innerWrapper">
                          <div class="block-body">
              
                  <div>
        <div class="field-formatter--text-default field-text-format--wysiwyg text-formatted body"><ul class="tall"><li>Office of the Inspector General</li>
<li><a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="2f833018-5f4d-469e-9447-3669b4da5f97" href="/jmd/eeo-program-status-report" title="Data Posted Pursuant To The No Fear Act">No FEAR Act Data</a></li>
<li><a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="ca4b7f8c-31b8-4043-80a1-b291f345c659" href="/jmd/vulnerability-disclosure-policy" title="Vulnerability Disclosure Policy (VDP)">Vulnerability Disclosure</a></li>
</ul></div>
      </div>
            
          </div>
              </div>
    </div>
  </div>



<div id="block-footercolumn4" class="footer-column4-block settings-tray-editable block block-general block-block-content block-block-contentc77ade55-b6e5-4398-b0b6-a75001c3c52a bg-full-width bg-none block_full_width" data-drupal-settingstray="editable">

  
    
      <div class="block-content">
      <div class="block-general__innerWrapper">
                          <div class="block-body">
              
                  <div>
        <div class="field-formatter--text-default field-text-format--wysiwyg text-formatted body"><ul class="tall">
<li>Español</li>
<li>Vote.gov</li>
<!--<li><a class="icon-link" href="#"><svg fill="white" height="20" viewbox="0 0 24 24" width="20" xmlns="http://www.w3.org/2000/svg"><path d="M0 0h24v24H0z" fill="none"></path><path d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm-1 17.93c-3.95-.49-7-3.85-7-7.93 0-.62.08-1.21.21-1.79L9 15v1c0 1.1.9 2 2 2v1.93zm6.9-2.54c-.26-.81-1-1.39-1.9-1.39h-1v-3c0-.55-.45-1-1-1H8v-2h2c.55 0 1-.45 1-1V7h2c1.1 0 2-.9 2-2v-.41c2.93 1.19 5 4.06 5 7.41 0 2.08-.8 3.97-2.1 5.39z"></path></svg>Multilingual Resources</a></li>--></ul>

<p><strong class="accent-warm">Have a question about Government Services?</strong></p>

<ul class="tall">
<li>Contact USA.gov</li>
</ul>
</div>
      </div>
            
          </div>
              </div>
    </div>
  </div>

  </div>

              </div>
            </div>
          
        </div>
      </div>
      </div>
    
    <div class="return-to-top grid-container">
      <a href="#">
        <img src="/themes/custom/usdoj_uswds/images/doj-icon-back-top-arrow-up.png"
             alt="Return to the top of the page." width="136" height="76"/>
        Top</a>
    </div>
  </footer>

  </div>

          
          <script type="application/json" data-drupal-selector="drupal-settings-json">{"path":{"baseUrl":"\/","scriptPath":null,"pathPrefix":"","currentPath":"node\/190476","currentPathIsAdmin":false,"isFront":false,"currentLanguage":"en"},"pluralDelimiter":"\u0003","suppressDeprecationErrors":true,"data":{"extlink":{"extTarget":true,"extTargetNoOverride":true,"extNofollow":false,"extNoreferrer":false,"extFollowNoOverride":false,"extClass":"ext","extLabel":"Links to other government and non-government sites will typically appear with the \u201cexternal link\u201d icon to indicate that you are leaving the Department of Justice website when you click the link.","extImgClass":false,"extSubdomains":true,"extExclude":"","extInclude":"","extCssExclude":"","extCssExplicit":"","extAlert":false,"extAlertText":"","mailtoClass":"0","mailtoLabel":"(link sends email)","extUseFontAwesome":false,"extIconPlacement":"append","extFaLinkClasses":"fa fa-external-link","extFaMailtoClasses":"fa fa-envelope-o","whitelistedDomains":["www.justice.gov","www.fbi.gov","www.dea.gov","www.atf.gov","www.ojp.gov","cops.usdoj.gov","justicegrants.usdoj.gov","bja.ojp.gov","bjs.ojp.gov","nij.ojp.gov","ojjdp.ojp.gov","ovc.ojp.gov","smart.ojp.gov","oig.justice.gov","tips.fbi.gov","www.bop.gov","www.usmarshals.gov","bjs.gov","nij.gov","bja.gov","ovc.gov","cops.gov","ojp.gov","www.bja.gov","www.bjs.gov","www.nij.gov","www.ovc.gov","www.cops.usdoj.gov\/","unicor.gov","www.unicor.gov","www.ovcttac.gov","ovc.ojp.gov","www.ojjdp.gov","ada.gov","www.ada.gov","beta.ada.gov","www.ic3.gov","vault.fbi.gov","bankrobbers.fbi.gov","www.deadiversion.usdoj.gov","www.ncjrs.gov","nicic.gov","www.nicic.gov","vcf.gov","www.vcf.gov","www.getsmartaboutdrugs.gov","www.justthinktwice.gov","getsmartaboutdrugs.gov","crimesolutions.ojp.gov","foia.gov","www.foia.gov","www.nsopw.gov","fara.gov","efile.fara.gov","www.fara.gov","data.ojp.usdoj.gov","cde.ucr.cjis.gov","forfeiture.gov","www.forfeiture.gov","fbijobs.gov","nlead.usdoj.gov","www.nlead.gov","nlead.gov","biz.fbi.gov"]}},"collapsiblock":{"active_pages":false,"slide_type":1,"slide_speed":200},"user":{"uid":0,"permissionsHash":"b6cfd961a159c6f023024d5992423946f0f6a551d9117074a6a915045565e73a"}}</script>
<script src="/d9/js/js_7wiF-9iIQgtOkdfW98yefFbz9Ev00SPAbE4pyaSR4rI.js"></script>


            <script type="text/javascript" src="//cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/slick.min.js"></script>
            </body>
          </html>