An independent researcher emails a company's security team about a flaw in its public website. The company has no published process for outside reports, and management does not want to offer financial rewards. Which should the company establish so future reports arrive through a defined channel with agreed rules?

A responsible disclosure policy, sometimes called a vulnerability disclosure policy, tells outside researchers how to report security issues, what systems and testing activities are in scope, what the organization commits to in response, and how coordinated public disclosure will be timed after a fix. Many policies also state that good-faith research within the rules will not be pursued legally, which encourages reporting through the intended channel. It meets the requirement without financial rewards; a bug bounty program adds payments on top of similar rules, which management has ruled out. Sending legal threats and blocking reporters discourages disclosure, pushing researchers toward public release or silence while the flaw remains exploitable. Publishing every reported flaw immediately exposes customers to attack before a fix exists, which is the opposite of coordinated disclosure. Logging reports only in an internal risk register may help tracking, but it gives outsiders no channel or expectations and leaves the reporter without a response. Exam caveat: disclosure policies are external reporting mechanisms in vulnerability management, distinct from internal management reporting. Operational check: publish the policy at a predictable location with a monitored contact address, and run a test submission to confirm triage acknowledges it.