Several security standards require organizations to have a vulnerability disclosure policy (VDP) or bug bounty program (BBP). You can generate a proof of compliance report for your program on HackerOne to prove that your organization has a VDP or BBP. The downloadable statement of attestation meets the requirements necessary to comply with various security standards.
These are some of the security standards that can be met with the statement of attestation:
If you’re a federal program that needs to comply with CISA BOD 20-01, you can choose to download the Program performance per asset CSV file and input the data into CyberScope.
To generate your proof of compliance report:
Navigate to Program Settings > Program > Reports > Proof of Compliance.
Select the dates that you would like the report to reflect.
Select the documents you want to include in the report. You can choose from the list below, then click Download.
Option | Details |
Statement of attestation | A PDF that proves that your program has either a VDP or BBP on HackerOne. |
Program performance per asset | (Mainly for federal programs) A CSV file comprised of metrics on each of your program’s assets. Some metrics include median time to resolution, number of found vulnerabilities, and the number of critical vulnerabilities that have been open for longer than 90 days. |
You can submit your downloaded report to your compliance officer to meet security standards.