{"id":73364,"date":"2025-10-22T06:00:00","date_gmt":"2025-10-22T10:00:00","guid":{"rendered":"https:\/\/statescoop.com\/?p=73364"},"modified":"2025-10-22T11:02:10","modified_gmt":"2025-10-22T15:02:10","slug":"maryland-vdp-md-isac-expansion","status":"publish","type":"post","link":"https:\/\/statescoop.com\/maryland-vdp-md-isac-expansion\/","title":{"rendered":"Maryland creates vulnerability disclosure program, expands ISAC statewide"},"content":{"rendered":"\n

Maryland\u2019s top cybersecurity official on Tuesday announced on social media<\/a> that the state has launched a vulnerability disclosure program, providing white-hat hackers an official avenue to share security issues they discover on the state\u2019s websites and other online properties.<\/p>\n\n\n\n

The state joins a small club of government organizations outside of the federal government to run such a program. California has run a VDP<\/a> for several years, as has New York City<\/a>. Ohio Secretary of State Frank LaRose runs one<\/a> for the state\u2019s election-related websites.<\/p>\n\n\n\n

James Saunders, Maryland\u2019s acting chief information security officer, said his state\u2019s new program<\/a>, which is supported by the bug bounty firm Bugcrowd, is \u201cprobably the most aggressive\u201d in the nation.<\/p>\n\n\n\n

\u201cThat’s the beauty of our VDP. We’re covering our executive branch, we’re covering our locals, we’re covering all the units of government so that we can protect and get some insight into vulnerabilities before a threat actor takes advantage of them,\u201d Saunders said.<\/p>\n\n\n\n

Christopher Krawiec, the state\u2019s director of cyber resilience, said the program originated with Lance Cleghorn, Maryland\u2019s director of state cyber security, who spent three years at the Defense Digital Service<\/a> at the Department of Defense. Krawiec said it was \u201ca passion project\u201d of Cleghorn\u2019s to launch a VDP in the state.<\/p>\n\n\n\n

There are others at the Maryland Department of Information Technology who may also have been inclined to see the sense in a VDP. Saunders spent seven years in the federal government, at the Office of Personnel Management and the Small Business Administration, before joining the state. Katie Savage, Maryland’s chief information officer, also served several years at the Defense Digital Service before taking her current role.<\/p>\n\n\n\n

At federal agencies, VDPs have been required since a 2020 directive<\/a> from the Cybersecurity and Infrastructure Security Agency noted that reporting vulnerabilities can be \u201cfrustrating\u201d for reporters when federal agencies haven\u2019t published clear policies. CISA noted that without clear policies, reporters might not know the right way to report bugs, and if they do report one, they may not know if it’s being fixed, and, perhaps most saliently, they may (rightly) fear legal action.<\/p>\n\n\n\n

\u201cTo many in the information security community, the federal government has a reputation for being defensive or litigious in dealing with outside security researchers,\u201d the CISA directive read. \u201cCompounding this, many government information systems are accompanied by strongly worded legalistic statements warning visitors against unauthorized use.\u201d<\/p>\n\n\n\n

In 2021, Mike Parson, then Missouri’s governor, accused a newspaper reporter<\/a> who had discovered a security flaw on a public website of \u201chacking\u201d the state\u2019s sensitive data and threatened him and his colleagues with legal action. Several months later, the governor backed down<\/a> and said he would not pursue legal charges, but not before stirring much acrimony and confusion.<\/p>\n\n\n\n

Saunders said his state\u2019s VDP is intended to put all good-faith contributors on the same team, \u201cTeam Maryland,\u201d and pointed out that there are many bad actors afoot who have clearly chosen \u201cTeam Not-Maryland.\u201d<\/p>\n\n\n\n

\u201cI think this is a huge culture play,\u201d Saunders said. \u201cI’m pretty sure you’ve heard 1,000 times cybersecurity is a team sport \u2014 this is rooted in that, in a sense. We’re taking the collective knowledge of everyone in Maryland, across the United States, potentially globally, as well, so that if they see something they can say something, without concerns of negative reprisals.\u201d<\/p>\n\n\n\n

Krawiec, Maryland\u2019s cyber resilience director, said the state VDP\u2019s safe harbor clause is its cornerstone.<\/p>\n\n\n\n

\u201cIt basically says if you operate in good faith and engage with us for a responsible disclosure \u2026 then we will consider your work good faith and we will not pursue legal action against you,\u201d he said. \u201cAnd if someone else pursues legal action against you, then we will make the authorization of that activity known.\u201d<\/p>\n\n\n\n

Maryland ran a bug bounty program<\/a> last year, over the course of a month, which yielded more than 40 new vulnerabilities. But unlike a bug bounty program, which usually has a limited scope or timeframe, the state\u2019s VDP is here to stay, Krawiec said.<\/p>\n\n\n\n

On top of Maryland\u2019s VDP, Saunders announced that the state is also expanding its threat-intelligence organization. A directive issued last week<\/a> requires all government organizations throughout the state to enroll in the Maryland Information Sharing and Analysis Center \u2014 from state agencies down to counties, K-12 schools, boards and commissions. The requirement will further expand, in six months, to include participation by critical infrastructure operators and technology vendors.<\/p>\n\n\n\n

Saunders said expanding the MD-ISAC is \u201ccritically important\u201d because rapidly sharing information is the lifeblood of cybersecurity defense, \u201cespecially against attackers who are leveraging AI and other automation capabilities.\u201d This directive, he said, will \u201craise the floor\u201d of the state\u2019s cybersecurity resilience.<\/p>\n","protected":false},"excerpt":{"rendered":"

Maryland’s VDP puts it in a small group of state and local governments to run similar programs. The state is also requiring all government organizations in its borders to join the MD-ISAC.<\/p>\n","protected":false},"author":205,"featured_media":72532,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"disable_grayscale_images":true,"grayscale_contrast":0,"sponsored_content":false,"display_author_bio":true,"story_type":"","footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[20646],"tags":[248,16536,25934,25935,25936,25937],"people":[],"special-report":[],"authors":[4696],"class_list":["post-73364","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-maryland","tag-cybersecurity","tag-vulnerability-disclosure-program","tag-vdp","tag-md-isac","tag-cyber-defense","author-colin-wood"],"yoast_head":"\nMaryland creates vulnerability disclosure program, expands ISAC statewide | StateScoop<\/title>\n<meta name=\"description\" content=\"Maryland's VDP puts it in a small group of state and local governments to run similar programs. The state is also requiring all government organizations in its borders to join the MD-ISAC.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/statescoop.com\/maryland-vdp-md-isac-expansion\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Maryland creates vulnerability disclosure program, expands ISAC statewide | StateScoop\" \/>\n<meta property=\"og:description\" content=\"Maryland's VDP puts it in a small group of state and local governments to run similar programs. The state is also requiring all government organizations in its borders to join the MD-ISAC.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/statescoop.com\/maryland-vdp-md-isac-expansion\/\" \/>\n<meta property=\"og:site_name\" content=\"StateScoop\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/StateScoop\/\" \/>\n<meta property=\"article:published_time\" content=\"2025-10-22T10:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-10-22T15:02:10+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/08\/GettyImages-607346087.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1300\" \/>\n\t<meta property=\"og:image:height\" content=\"867\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Colin Wood\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@State_Scoop\" \/>\n<meta name=\"twitter:site\" content=\"@State_Scoop\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/statescoop.com\/maryland-vdp-md-isac-expansion\/\",\"url\":\"https:\/\/statescoop.com\/maryland-vdp-md-isac-expansion\/\",\"name\":\"Maryland creates vulnerability disclosure program, expands ISAC statewide | StateScoop\",\"isPartOf\":{\"@id\":\"https:\/\/statescoop.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/statescoop.com\/maryland-vdp-md-isac-expansion\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/statescoop.com\/maryland-vdp-md-isac-expansion\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/08\/GettyImages-607346087.jpg\",\"datePublished\":\"2025-10-22T10:00:00+00:00\",\"dateModified\":\"2025-10-22T15:02:10+00:00\",\"description\":\"Maryland's VDP puts it in a small group of state and local governments to run similar programs. The state is also requiring all government organizations in its borders to join the MD-ISAC.\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/statescoop.com\/maryland-vdp-md-isac-expansion\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/statescoop.com\/maryland-vdp-md-isac-expansion\/#primaryimage\",\"url\":\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/08\/GettyImages-607346087.jpg\",\"contentUrl\":\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/08\/GettyImages-607346087.jpg\",\"width\":1300,\"height\":867,\"caption\":\"(Getty Images)\"},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/statescoop.com\/#website\",\"url\":\"https:\/\/statescoop.com\/\",\"name\":\"StateScoop\",\"description\":\"Latest news and events in state and local government technology\",\"publisher\":{\"@id\":\"https:\/\/statescoop.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/statescoop.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/statescoop.com\/#organization\",\"name\":\"StateScoop\",\"url\":\"https:\/\/statescoop.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/statescoop.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/StateScoop-Black.png\",\"contentUrl\":\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/StateScoop-Black.png\",\"width\":1470,\"height\":186,\"caption\":\"StateScoop\"},\"image\":{\"@id\":\"https:\/\/statescoop.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/StateScoop\/\",\"https:\/\/x.com\/State_Scoop\",\"https:\/\/www.linkedin.com\/company\/statescoop\/\",\"https:\/\/www.youtube.com\/@StateScoop\"]}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Maryland creates vulnerability disclosure program, expands ISAC statewide | StateScoop","description":"Maryland's VDP puts it in a small group of state and local governments to run similar programs. The state is also requiring all government organizations in its borders to join the MD-ISAC.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/statescoop.com\/maryland-vdp-md-isac-expansion\/","og_locale":"en_US","og_type":"article","og_title":"Maryland creates vulnerability disclosure program, expands ISAC statewide | StateScoop","og_description":"Maryland's VDP puts it in a small group of state and local governments to run similar programs. The state is also requiring all government organizations in its borders to join the MD-ISAC.","og_url":"https:\/\/statescoop.com\/maryland-vdp-md-isac-expansion\/","og_site_name":"StateScoop","article_publisher":"https:\/\/www.facebook.com\/StateScoop\/","article_published_time":"2025-10-22T10:00:00+00:00","article_modified_time":"2025-10-22T15:02:10+00:00","og_image":[{"width":1300,"height":867,"url":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/08\/GettyImages-607346087.jpg","type":"image\/jpeg"}],"author":"Colin Wood","twitter_card":"summary_large_image","twitter_creator":"@State_Scoop","twitter_site":"@State_Scoop","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/statescoop.com\/maryland-vdp-md-isac-expansion\/","url":"https:\/\/statescoop.com\/maryland-vdp-md-isac-expansion\/","name":"Maryland creates vulnerability disclosure program, expands ISAC statewide | StateScoop","isPartOf":{"@id":"https:\/\/statescoop.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/statescoop.com\/maryland-vdp-md-isac-expansion\/#primaryimage"},"image":{"@id":"https:\/\/statescoop.com\/maryland-vdp-md-isac-expansion\/#primaryimage"},"thumbnailUrl":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/08\/GettyImages-607346087.jpg","datePublished":"2025-10-22T10:00:00+00:00","dateModified":"2025-10-22T15:02:10+00:00","description":"Maryland's VDP puts it in a small group of state and local governments to run similar programs. The state is also requiring all government organizations in its borders to join the MD-ISAC.","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/statescoop.com\/maryland-vdp-md-isac-expansion\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/statescoop.com\/maryland-vdp-md-isac-expansion\/#primaryimage","url":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/08\/GettyImages-607346087.jpg","contentUrl":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/08\/GettyImages-607346087.jpg","width":1300,"height":867,"caption":"(Getty Images)"},{"@type":"WebSite","@id":"https:\/\/statescoop.com\/#website","url":"https:\/\/statescoop.com\/","name":"StateScoop","description":"Latest news and events in state and local government technology","publisher":{"@id":"https:\/\/statescoop.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/statescoop.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/statescoop.com\/#organization","name":"StateScoop","url":"https:\/\/statescoop.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/statescoop.com\/#\/schema\/logo\/image\/","url":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/StateScoop-Black.png","contentUrl":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/StateScoop-Black.png","width":1470,"height":186,"caption":"StateScoop"},"image":{"@id":"https:\/\/statescoop.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/StateScoop\/","https:\/\/x.com\/State_Scoop","https:\/\/www.linkedin.com\/company\/statescoop\/","https:\/\/www.youtube.com\/@StateScoop"]}]}},"parsely":{"version":"1.1.0","canonical_url":"https:\/\/statescoop.com\/maryland-vdp-md-isac-expansion\/","smart_links":{"inbound":0,"outbound":0},"traffic_boost_suggestions_count":0,"meta":{"@context":"https:\/\/schema.org","@type":"NewsArticle","headline":"Maryland creates vulnerability disclosure program, expands ISAC statewide","url":"http:\/\/statescoop.com\/maryland-vdp-md-isac-expansion\/","mainEntityOfPage":{"@type":"WebPage","@id":"http:\/\/statescoop.com\/maryland-vdp-md-isac-expansion\/"},"thumbnailUrl":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/08\/GettyImages-607346087.jpg?w=150&h=150&crop=1","image":{"@type":"ImageObject","url":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/08\/GettyImages-607346087.jpg"},"articleSection":"Cybersecurity","author":[{"@type":"Person","name":"Colin Wood","url":"https:\/\/statescoop.com\/author\/colin-wood\/"}],"creator":["Colin Wood"],"publisher":{"@type":"Organization","name":"StateScoop","logo":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/cropped-ss_favicon.png"},"keywords":["cyber defense","cybersecurity","maryland","md-isac","vdp","vulnerability disclosure program"],"dateCreated":"2025-10-22T10:00:00Z","datePublished":"2025-10-22T10:00:00Z","dateModified":"2025-10-22T15:02:10Z"},"rendered":"<script type=\"application\/ld+json\" class=\"wp-parsely-metadata\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@type\":\"NewsArticle\",\"headline\":\"Maryland creates vulnerability disclosure program, expands ISAC statewide\",\"url\":\"http:\\\/\\\/statescoop.com\\\/maryland-vdp-md-isac-expansion\\\/\",\"mainEntityOfPage\":{\"@type\":\"WebPage\",\"@id\":\"http:\\\/\\\/statescoop.com\\\/maryland-vdp-md-isac-expansion\\\/\"},\"thumbnailUrl\":\"https:\\\/\\\/statescoop.com\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2025\\\/08\\\/GettyImages-607346087.jpg?w=150&h=150&crop=1\",\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/statescoop.com\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2025\\\/08\\\/GettyImages-607346087.jpg\"},\"articleSection\":\"Cybersecurity\",\"author\":[{\"@type\":\"Person\",\"name\":\"Colin Wood\",\"url\":\"https:\\\/\\\/statescoop.com\\\/author\\\/colin-wood\\\/\"}],\"creator\":[\"Colin Wood\"],\"publisher\":{\"@type\":\"Organization\",\"name\":\"StateScoop\",\"logo\":\"https:\\\/\\\/statescoop.com\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2023\\\/01\\\/cropped-ss_favicon.png\"},\"keywords\":[\"cyber defense\",\"cybersecurity\",\"maryland\",\"md-isac\",\"vdp\",\"vulnerability disclosure program\"],\"dateCreated\":\"2025-10-22T10:00:00Z\",\"datePublished\":\"2025-10-22T10:00:00Z\",\"dateModified\":\"2025-10-22T15:02:10Z\"}<\/script>","tracker_url":"https:\/\/cdn.parsely.com\/keys\/statescoop.com\/p.js"},"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/08\/GettyImages-607346087.jpg","distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"StateScoop","distributor_original_site_url":"https:\/\/statescoop.com","push-errors":false,"_links":{"self":[{"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/posts\/73364","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/users\/205"}],"replies":[{"embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/comments?post=73364"}],"version-history":[{"count":3,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/posts\/73364\/revisions"}],"predecessor-version":[{"id":73368,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/posts\/73364\/revisions\/73368"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/media\/72532"}],"wp:attachment":[{"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/media?parent=73364"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/categories?post=73364"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/tags?post=73364"},{"taxonomy":"people","embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/people?post=73364"},{"taxonomy":"special-report","embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/special-report?post=73364"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/authors?post=73364"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}