Security frameworks and what they ask about vulnerabilities.
Most certifications, audits and privacy laws ask the same thing in different words: find security flaws, fix them in time and keep a record. Here is what each one requires and where a disclosure or bug bounty program on RootBounty fits.
RootBounty does not hold these certifications and does not certify anyone. This page explains each framework so your organisation can use its program as evidence. It is general information, not legal advice: check the official text and your auditor.
State of California — California Consumer Privacy Act, amended by the CPRA; enforced by the California Privacy Protection Agency and the Attorney General
ISO and IEC — Vulnerability handling processes (2019)
SOC 2 Type 2
Audit report
Issued by
AICPA (American Institute of CPAs); issued by an independent CPA firm
Who it applies to
Service organisations, mostly SaaS and cloud providers, whose customers ask for assurance about how their data is protected.
What it asks about vulnerabilities
It is an attestation report, not a certificate: an auditor checks that your controls meet the Trust Services Criteria (security, availability, processing integrity, confidentiality and privacy) and that they worked during a period, usually 3 to 12 months.
CC7.1: procedures to detect new vulnerabilities and configuration changes.
CC7.2 to CC7.4: monitor for anomalies, evaluate security events and respond to incidents.
CC4.1: ongoing and separate evaluations of controls, such as penetration testing.
How a program on RootBounty helps
Every report keeps its dates: received, triaged, accepted, fixed. That timeline is the evidence the auditor samples for the period.
Severity in CVSS 4.0 and the weakness in CWE, so you can show findings were ranked and handled by risk.
Published response times show a defined process, not ad-hoc emails.
ISO and IEC; certified by an accredited certification body
Who it applies to
Any organisation that wants to certify its information security management system (ISMS). Certificates last three years, with yearly surveillance audits.
What it asks about vulnerabilities
A risk-based ISMS with the controls of Annex A that apply to you (2022 edition).
A.8.8 Management of technical vulnerabilities: get information about vulnerabilities in time, evaluate your exposure and act on it.
A.5.24 to A.5.26: plan incident management, assess security events and respond to incidents.
A.5.7 Threat intelligence.
How a program on RootBounty helps
An external source of vulnerability information that A.8.8 asks for, with a record of how each one was evaluated and closed.
Report history and statuses as audit evidence of the process working.
Scope and guidelines written per program, matching the scope of your ISMS.
Anyone processing personal data of people in the EU, wherever the organisation is. It is a law, not a certification: there is no "GDPR certificate" that makes you compliant.
What it asks about vulnerabilities
Art. 32: security appropriate to the risk, including "a process for regularly testing, assessing and evaluating" the effectiveness of your measures.
Art. 25: data protection by design and by default.
Art. 33 and 34: notify a personal data breach to the authority within 72 hours and, if the risk is high, to the people affected.
Fines up to €20 million or 4% of worldwide annual turnover (Art. 83).
How a program on RootBounty helps
A continuous way of testing your systems, as Art. 32(1)(d) asks, carried out by independent researchers.
Flaws reach you privately before they become a breach you have to notify.
Programs can forbid accessing personal data beyond what proves the issue, and reports stay confidential.
PCI Security Standards Council (Visa, Mastercard, American Express, Discover, JCB, UnionPay)
Who it applies to
Every organisation that stores, processes or transmits payment card data. Compliance is validated by a Qualified Security Assessor or a self-assessment questionnaire, depending on volume.
What it asks about vulnerabilities
Version 4.0.1, Req. 6.3.1: identify new security vulnerabilities from recognised sources and rank them by risk.
Req. 6.3.3: install critical security patches within one month of release.
Req. 11.3: internal and external vulnerability scans every three months (external ones by an Approved Scanning Vendor).
Req. 11.4: penetration testing at least once a year and after significant changes.
How a program on RootBounty helps
Reports are a recognised source of new vulnerabilities in your own systems for Req. 6.3.1, already ranked with CVSS 4.0.
Continuous testing between the yearly penetration tests.
It complements scans and penetration tests; it does not replace them.
State of California — California Consumer Privacy Act, amended by the CPRA; enforced by the California Privacy Protection Agency and the Attorney General
Who it applies to
For-profit businesses that handle personal information of California residents and pass a threshold: revenue above about US$25 million (adjusted for inflation), personal information of 100,000 or more consumers or households, or half their revenue from selling or sharing it. It is a law, not a certification.
What it asks about vulnerabilities
Reasonable security procedures and practices appropriate to the nature of the information (Civil Code §1798.100 and §1798.81.5).
§1798.150: consumers can sue after a breach caused by a lack of reasonable security, with statutory damages per consumer and incident (US$100–750, adjusted for inflation).
Regulations adopted in 2025 add yearly independent cybersecurity audits for businesses whose processing is high-risk, phased in from 2028.
How a program on RootBounty helps
Shows an active practice of finding and fixing flaws, which is part of what "reasonable security" means.
Reduces the chance of the breach that opens the door to §1798.150 claims.
Report history is material for the cybersecurity audit.
US General Services Administration (GSA) — Federal Risk and Authorization Management Program
Who it applies to
Cloud services sold to US federal agencies. It is an authorisation granted after an assessment by an accredited third party (3PAO), followed by continuous monitoring.
What it asks about vulnerabilities
Controls from NIST SP 800-53 Rev. 5 at the Low, Moderate or High baseline.
RA-5: vulnerability monitoring and scanning; RA-5(11) adds a public disclosure program, a channel for anyone to report vulnerabilities.
SI-2 flaw remediation and CA-8 penetration testing.
Continuous monitoring: monthly scans and remediation deadlines (30 days for high risk, 90 for moderate, 180 for low).
How a program on RootBounty helps
A public disclosure channel of the kind RA-5(11) describes.
Dated reports to show remediation deadlines were met in your plan of action and milestones (POA&M).
US federal agencies themselves must run a vulnerability disclosure policy (CISA BOD 20-01).
Vendor Security Alliance, a non-profit coalition of companies
Who it applies to
Suppliers assessed by their customers. VSA publishes standard questionnaires (VSA Full, VSA Core, privacy) updated every year. It is a self-assessment, not a certification.
What it asks about vulnerabilities
How you manage vulnerabilities and patches, and how fast.
Whether you run penetration tests and whether there is a way for outsiders to report vulnerabilities to you (a disclosure or bug bounty program).
Incident response and how you notify customers.
How a program on RootBounty helps
A truthful "yes" to the disclosure program question, with a public program page to link.
Figures you can answer with: reports received, response times, time to fix.
US Department of Commerce, under the European Commission adequacy decision of 10 July 2023
Who it applies to
US organisations that receive personal data from the EU (with UK and Swiss extensions). They self-certify with the Department of Commerce and re-certify every year; the FTC or the Department of Transportation enforce it.
What it asks about vulnerabilities
Follow the DPF Principles: notice, choice, onward transfer, security, data integrity and purpose limitation, access, recourse and enforcement.
Security Principle: reasonable and appropriate measures to protect personal data from loss, misuse, unauthorised access, disclosure, alteration and destruction.
How a program on RootBounty helps
Independent, ongoing testing of the systems that hold the transferred data, as part of the "reasonable and appropriate" measures.
For EU companies: a way to ask your US providers how they handle the vulnerabilities reported to them.
UK National Cyber Security Centre (NCSC); delivered by IASME and its certification bodies
Who it applies to
Organisations of any size in the UK, and a requirement for some UK government contracts. Plus adds a hands-on technical audit to the self-assessment; it lasts 12 months.
What it asks about vulnerabilities
Five technical controls: firewalls, secure configuration, user access control, malware protection and security update management.
High and critical security updates installed within 14 days of release.
An assessor tests your internet-facing systems and a sample of devices.
How a program on RootBounty helps
Researchers look at the same internet-facing systems the assessor will, before the audit and all year round.
Misconfigurations and missing updates found in reports point to which of the five controls failed.
Vendors and service providers that receive vulnerability reports from outside. It gives guidance and is not certified on its own; other frameworks and laws point to it.
What it asks about vulnerabilities
A known, public way to receive reports, and an acknowledgement to the person who reports.
Keep in touch with the finder, coordinate with other affected parties and agree when to publish.
Publish advisories that tell users how to fix or mitigate.
How a program on RootBounty helps
This is what RootBounty does: a public program page as the reporting channel, private conversation with the researcher in each report and coordinated disclosure.
Published response times and a disclosure policy, with safe harbor for good-faith research.