U.S. flagAn official website of the United States government
      Here's how you know **The .gov means it’s official.**
            
            Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you’re on a federal government site.
 **The site is secure.**
            
            The **https://** ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.


U.S. Merit Systems Protection Board
 Menu


close HomeAbout
    About the MSPB	
			Contacts & Locations
			Equal Employment Opportunity
			Information Quality Standards
			No FEAR Act
			Open.Gov
			Organization
			Plans, Budget & Performance
			Privacy Program
           Merit System Principles
	Prohibited Personnel Practices
	 Site Index and SearchAppeals
    Appeal Process
						Appellant Q&A
    Electronic Filing
    Forms
    Hearing Sites
  	Mediation Appeals Program

		 Policy & Resources
    Regulations
    Whistleblower Q&ADecisions
    Case Reports
Nonprecedential Decisions
		Precedential DecisionsStudies & Publications
       About & Contact Studies
		Latest Publications
		Newsletters
		Reports
          Research Briefs
		Search StudiesSurveys of Federal Employees Public & Information Services
    Accessibility
		   Contracting & Procurement
			  Federal Register Notices
		      FOIA Program
				 e-FOIA Reading Room
        Submit a FOIA Request
           FOIA Reports 
			Information Collections
			Jobs & Internships
	Press Releases & News
	Privacy Program
				Regulations
			    Technical Support Search small
Search




Home
	
    Search & Site Index Vulnerability Disclosure Policy
	
	
	
	
	
As a U.S. government agency, The Merit Systems Protection Board (MSPB) is committed to ensuring the security of the American public by protecting their information. This policy is intended to give security researchers clear guidelines for conducting vulnerability discovery activities and to convey our preferences in how to submit discovered vulnerabilities to us.
This policy describes what systems and types of research are covered under this policy, how to send us vulnerability reports, and how long we ask security researchers to wait before publicly disclosing vulnerabilities.
We encourage you to contact us to report potential vulnerabilities in our systems.

Authorization
If you make a good faith effort to comply with this policy during your security research, we will consider your research to be authorized we will work with you to understand and resolve the issue quickly, and MSPB will not recommend or pursue legal action related to your research. Should legal action be initiated by a third party against you for activities that were conducted in accordance with this policy, we will make this authorization known.Guidelines
	Under this policy, “research” means activities in which you:
	Notify us as soon as possible after you discover a real or potential security issue.
 Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data.
Only use exploits to the extent necessary to confirm a vulnerability’s presence. Do not use an exploit to compromise or exfiltrate data, establish persistent command line access, or use the exploit to pivot to other systems.
Provide us a reasonable amount of time to resolve the issue before you disclose it publicly.
Do not submit a high volume of low-quality reports.Once you’ve established that a vulnerability exists or encounter any sensitive data (including personally identifiable information, financial information, or proprietary information or trade secrets of any party),**you must stop your test, notify us immediately, and not disclose this data to anyone else.**
	
	Test methods
	
	The following test types are not authorized:
User interface bugs or typos.
	Network denial of service (DoS or DDoS) tests.
Physical testing (e.g. office access, open doors, tailgating), social engineering (e.g. phishing, vishing), or any other non-technical vulnerability testing.
Brute Force Attacks against login interfaces.If you encounter any of the below on our systems while testing within the scope of this policy, stop your test and notify us immediately. Disclosure of the following may not be made to any third party:
Personally identifiable information (PII).
Financial information (e.g. credit card or bank account numbers).
Proprietary information or trade secrets of companies of any party.Scope

This policy applies to the following systems and services:
*.mspb.gov
mspb.govAny other subdomain of mspb.gov and all customer applications are excluded from this policy.

**Any service not expressly listed above, such as any connected services, are excluded from scope** and are not authorized for testing. Additionally, vulnerabilities found in systems from our vendors fall outside of this policy’s scope and should be reported directly to the vendor according to their disclosure policy (if any). If you aren’t sure whether a system is in scope or not, contact us at SecurityTeam@mspb.gov before starting your research.

Though we develop and maintain other internet-accessible systems or services, we ask that *active research and testing* only be conducted on the systems and services covered by the scope of this document. If there is a particular system not in scope that you think merits testing, please contact us to discuss it first. We will increase the scope of this policy over time.

Reporting a vulnerability

Information submitted under this policy will be used for defensive purposes only – to mitigate or remediate vulnerabilities. If your findings include newly discovered vulnerabilities that affect all users of a product or service and not solely MSPB, we may share your report with the Cybersecurity and Infrastructure Security Agency, where it will be handled under their coordinated vulnerability disclosure process. We will not share your name or contact information without express permission.

**We accept vulnerability reports via SecurityTeam@mspb.gov.** Reports may be submitted anonymously. If you share contact information, we will acknowledge receipt of your report within 3 business days.

We do not support PGP-encrypted emails. Do not share sensitive information through email.  If you believe it is necessary to share sensitive information with us, please indicate as such on the report and MSPB will reach out to establish a more secure method.

What we would like to see from you

In order to help us triage and prioritize submissions, we recommend that your reports:

Describe the location the vulnerability was discovered and the potential impact of exploitation.Offer a detailed description of the steps needed to reproduce the vulnerability (proof of concept scripts or screenshots are helpful).
	Be in English, if possible.What you can expect from us

When you choose to share your contact information with us, we commit to coordinating with you as openly and as quickly as possible.

Within 3 business days, we will acknowledge that your report has been received.
To the best of our ability, we will confirm the existence of the vulnerability to you and be as transparent as possible about what steps we are taking during the remediation process, including on issues or challenges that may delay resolution.
We will maintain an open dialogue to discuss issues.Questions

Questions regarding this policy may be sent to SecurityTeam@mspb.gov. We also invite you to contact us with suggestions for improving this policy.

 

The shortcut for this page is mspb.gov/vulnerability-disclosure-policy.


Return to top


About MSPB
			  Accessibility
           Budget and Performance
          FOIA
          Info Quality Standards
          No FEAR Act
    
          Office of the Inspector General
          Privacy Program   
           Technical Support       USA.gov
		OSC.gov
				 Vote.gov


U.S. Merit Systems Protection Board
 Agency Contact Center (202) 653-7200
          mspb@mspb.gov