# New draft NIST doc on govt vuln disclosure policies

**URL:** <https://community.disclose.io/t/new-draft-nist-doc-on-govt-vuln-disclosure-policies/225>\
**Category:** Ideas\
**Created:** [June 10, 2021, 6:52pm UTC](https://community.disclose.io/t/new-draft-nist-doc-on-govt-vuln-disclosure-policies/225 "2021-06-10T18:52:10Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![allanfriedman](https://yyz2.discourse-cdn.com/flex028/user_avatar/community.disclose.io/allanfriedman/32/116_2.png) [@allanfriedman](https://community.disclose.io/u/allanfriedman)\
**Post date:** [June 10, 2021, 6:52pm UTC](https://community.disclose.io/t/new-draft-nist-doc-on-govt-vuln-disclosure-policies/225/1 "2021-06-10T18:52:10Z")

</div>

In the US, there has been a growing effort for US government agencies to have vulnerability disclosure policies. This was codified into law, and the National Institute of Standards and Technology was directed to establish guidelines.

The first draft has been published, as NIST Special Publication 800-216. They are looking for comments and feedback, and I strongly encourage the [Disclose.io](http://Disclose.io) community to offer feedback, either as individuals, or as a collective of experts.

The draft is here: [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-216-draft.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-216-draft.pdf)

I work closely with the NIST team, but am happy to help offer advice on how to share feedback constructively, and frame your comments to have maximum impact.

---

<div class="post-metadata">

**Author:** ![Yuan](https://yyz2.discourse-cdn.com/flex028/user_avatar/community.disclose.io/yuan/32/279_2.png) [@Yuan](https://community.disclose.io/u/Yuan)\
**Post date:** [July 19, 2021, 8:45pm UTC](https://community.disclose.io/t/new-draft-nist-doc-on-govt-vuln-disclosure-policies/225/2 "2021-07-19T20:45:37Z")

</div>

Hi Allan, do you think the folks at NIST would be open to receiving feedback from researchers such as myself in Canada with expertise on government vulnerability disclosure policies?

If so, I would also be interested in taking you up on your offer to help folks provide feedback constructively / framing comments to have maximum impact! May write you elsewhere in case you don’t reply here.