Audit of the Department’s Vulnerability Reporting and Resolution Program

We assessed the effectiveness of the Department’s program for managing public-reported vulnerabilities in its public-facing information technology systems. We found that the Department established a vulnerability disclosure program; however, it was not fully effective. Specifically, the Department’s vulnerability disclosure policy (VDP) did not include all internet-accessible systems, the VDP’s testing guidelines restricted the tools public security researchers could use to identify system vulnerabilities, the Department did not always fully remediate reported vulnerabilities, and the Department did not always remediate vulnerabilities within established deadlines.