www.crowncommercial.gov.uk Open in urlscan Pro
18.169.3.38  Public Scan

Form analysis
0 forms found in the DOM

Text Content

COOKIES ON CROWNCOMMERCIAL.GOV.UK

We use cookies to collect information about how you use crowncommercial.gov.uk.

We use this information to make the website work as well as possible and improve
government services.

Accept all cookiesSet cookie preferences
Skip to main content
Menu
 * Carbon Net Zero
 * About
 * Contact
 * Events
 * News
 * Buy and supply
 * call us: 0345 410 2222

 * Search agreements
 * Search suppliers
 * Upcoming deals
 * Products and Services
 * Sectors

 1. Home
 2. About ccs
 3. Vulnerability disclosure policy


VULNERABILITY DISCLOSURE POLICY

This is the Crown Commercial Service (CCS) Security Vulnerability Disclosure
Policy and applies to any vulnerabilities you are considering reporting to us.




1. INTRODUCTION

This is the Crown Commercial Service (CCS) Security Vulnerability Disclosure
Policy and applies to any vulnerabilities you are considering reporting to us. 

We recommend you read this disclosure policy before you report any
vulnerabilities. This will help to make sure that you understand the policy, and
act in compliance with it.

We actively endorse and support working with the research and security
practitioner community to improve our online security.

We welcome investigative work into security vulnerabilities, carried out by
well-intentioned and ethical security researchers. We are committed to:

 * investigating and resolving security issues in our platform and services
   thoroughly
 * working in collaboration with the security community
 * responding promptly and actively

This page explains how the CCS works with the security research community to
improve our online security.

Please note that this page does not provide any form of indemnity for any
actions if they are either in breach of the law or of this policy. It does not
provide an indemnity from the CCS or any third party.


2. SCOPE

This disclosure policy applies only to vulnerabilities in CCS products and
services under the following conditions:

 * ‘in scope’ vulnerabilities must be original, previously unreported, and not
   already discovered by internal procedures
 * volumetric vulnerabilities are not in scope, meaning that simply overwhelming
   a service with a high volume of requests is not in scope
 * reports of non-exploitable vulnerabilities, or reports indicating that our
   services do not fully align with “best practice”, for example missing
   security headers, are not in scope
 * TLS configuration weaknesses, for example “weak” cipher suite support or the
   presence of TLS1.0 support, are not in scope

The policy applies to everyone, including for example CCS staff, third party
suppliers and general users of CCS public services.


3. BUG BOUNTY

Unfortunately, due to CCS’ funding structure, we can’t offer a paid bug bounty
programme. We will, however, make efforts to show our appreciation to security
researchers who take the time and effort to investigate and report security
vulnerabilities to us according to this policy wherever we can.


4. REPORTING A VULNERABILITY

If you believe you have found a security vulnerability, please submit a
vulnerability report using the HackerOne platform.


IN YOUR REPORT PLEASE INCLUDE DETAILS OF:

 * the website, IP or page where the vulnerability can be observed
 * a brief description of the type of vulnerability, for example “XSS
   vulnerability”
 * steps to reproduce:
   * these should be a benign, non-destructive, proof of concept
   * this helps to ensure that the report can be triaged quickly and accurately
   * it also reduces the likelihood of duplicate reports, or malicious
     exploitation of some vulnerabilities, such as sub-domain takeovers


DOMAIN/IP OWNERSHIP

If you are not sure if CCS is responsible for a service or an IP address where
you’ve discovered something, contact the Cyber Security Team.

Alternatively, you can report issues to the National Cyber Security Centre
(NCSC). More information about how to do this is available on the NCSC
vulnerability-reporting page.


5. WHAT TO EXPECT AFTER SUBMITTING A REPORT

After you have submitted your report, we will try to respond to your report
within 5 working days and aim to triage your report within 10 working days.
We’ll also try to keep you informed of our progress.

To decide what order we will fix the issues reported, we look at the impact,
severity and exploit complexity. Vulnerability reports might take some time to
prioritise or fix. We need time to focus on the remediation, so you are welcome
to ask about the status of your report, but we will aim to respond to you within
14 working days. 

We will notify you when the vulnerability you reported is fixed, and we may ask
you to confirm that the solution works. You are also welcome to tell others
about your disclosure and the resolution (for example on a blog or your own
website). You will need to tell us when you plan to publish this so we can make
sure affected users have also received the guidance needed. 

We welcome feedback on the disclosure handling process, the clarity and quality
of the communication, and of course the effectiveness of the vulnerability
resolution. This feedback will be used in strict confidence to help us improve
our processes for handling reports, developing services, and resolving
vulnerabilities.

Where a report qualifies, we will offer to include you on our acknowledgement
page. We will ask you to confirm the details you would like to include before we
publish.


6. GUIDANCE

You must not:

 * break any applicable law or regulations
 * access unnecessary, excessive or significant amounts of data
   * for example, 2 or 3 records are enough to demonstrate most vulnerabilities
     such as enumeration or direct object reference vulnerability
 * modify data in our systems or services that do not belong to the researcher
 * use high-intensity invasive or destructive technical security scanning tools
   to find vulnerabilities
 * attempt or report any form of denial of service, for example, overwhelming a
   service with a high volume of requests
 * disrupt our services or systems
 * submit reports detailing non-exploitable vulnerabilities, or reports
   indicating that the services do not fully align with “best practice”, for
   example missing security headers
 * submit reports detailing TLS configuration weaknesses, for example “weak”
   cipher suite support or the presence of TLS1.0 support
 * communicate any vulnerabilities or associated details other than by means
   described in this policy or with anyone other than their assigned CCS
   security contact
 * violate the privacy of CCS users, staff, contractors, services or systems
   * for example by sharing, redistributing and/or not properly securing data
     retrieved from our systems or services
 * social engineer, ‘phish’ or physically attack CCS staff or infrastructure
 * demand financial compensation before disclosing any vulnerabilities

You must:

 * always comply with data protection rules and must not violate the privacy of
   any data that CCS holds
   * you must not, for example, share, redistribute or fail to properly secure
     data retrieved from the systems or services
 * securely delete all data retrieved during your research as soon as it is no
   longer required or within 1 month of the vulnerability being resolved,
   whichever occurs first (or as otherwise required by data protection law)

If you are unsure if your intended or actual actions are acceptable, contact the
Cyber Security Team for guidance, using our encryption key to protect any
sensitive details.


7. LEGALITIES

This policy is designed to be compatible with common good practice among
well-intentioned security researchers. It does not give you permission to act in
any manner that is inconsistent with the law, or which might cause CCS to be in
breach of any of its legal obligations, including but not limited to (as updated
from time to time):

 * The Computer Misuse Act (1990)
 * The General Data Protection Regulation 2016/679 (GDPR) and the Data
   Protection Act 2018
 * The Copyright, Designs and Patents Act (1988)
 * The Official Secrets Act (1989)

We affirm that we will not seek prosecution of any security researcher who
reports any security vulnerability on a CCS service or system, where the
researcher has acted in good faith and in accordance with this disclosure
policy.


8. FEEDBACK

If you wish to provide feedback or suggestions on this policy, contact the Cyber
Security Team. The policy will naturally evolve over time and your input is
welcome to ensure that the policy remains clear, complete, and relevant.

 


Print this page


YOU MIGHT ALSO BE INTERESTED IN:


AGGREGATION

Bulk buying, also known as aggregation, offers highly competitive prices and a
simple tender process.

Learn moreAggregation


YOU MIGHT ALSO BE INTERESTED IN:


CAN'T FIND WHAT YOU'RE LOOKING FOR?

If none of your requirements can be met by a CCS catalogue or agreement, you can
run an EU tender.

Learn moreCan't find what you're looking for?


 * Follow us on Twitter
 * Connect with us on LinkedIn

© Crown copyright


SITEMAP

 * Search agreements
 * Search suppliers
 * Upcoming deals
 * Buy through CCS
 * Buy and supply
 * About CCS
 * Contact us
 * News
 * Press Office


QUICK LINKS

 * Purchasing platform
 * Digital marketplace
 * eMarketplace login
 * eMarketplace registration
 * Fleet
 * Travel
 * Contracts Finder
 * eSourcing
 * Register for eSourcing training
 * Find a Tender
 * Tenders Electronic Daily (TED)
 * Submit your MI returns
 * Service Status
 * Sign up to our buyer newsletter


ABOUT AND CONTACT

 * About CCS
 * Contact CCS
 * Make a complaint
 * Careers with CCS
 * Terms and conditions
 * Cookie policy
 * Cookie settings
 * Corporate information
 * Privacy notice
 * Accessibility
 * Public Sector Equality Duty (PSED)
 * Vulnerability disclosure policy