Bug Reporting

ISACA is committed to ensuring the security of its information systems and member data by taking reasonable measures to ensure the confidentiality, integrity, and availability of ISACA systems in order to provide the best possible digital experience. We also firmly believe that empowering our users to provide their input strengthens that experience and builds trust in the IS/IT community.

To that end, ISACA is proud to introduce a Bug Bounty program! ISACA is welcoming you to the opportunity to spot and report flaws, vulnerabilities and other issues that may interfere with site functions and other digital assets—and prepared to reward you for your vigilance with ISACA swag! Simply complete the form below to report what you find.

More Details

Note: Please enable Third Party Cookies from Browser settings if you don't see the submission form, Or view this page in a normal window.

What is a Vulnerability?

A vulnerability is a “weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source.”

ISACA’s Vulnerability Disclosure Policy (VDP) has been setup to accommodate good-faith research that conforms to ISACA guidelines for consideration as authorized research. ISACA will work resolve the vulnerability identified when there is authorized research under this policy.

How do I Report a Bug?

We encourage security researchers to report potential vulnerabilities in ISACA systems by completing the form above. You can also contact us via email at BugReport@soongshinkid.com for any additional questions or comments.

Authorization:
ISACA welcomes the opportunity to hear from good faith security researchers, who conduct security research under these acceptable VDP guidelines.

Good faith research is not considered a security breach if it follows the guidelines below.

These Guidelines Require that You/a Researcher:

  1. Access an ISACA information system responsibly in a way that follows this VDP.
  2. Report a vulnerability that you discover by following the instructions.
  3. Make every effort to prevent privacy violations, performance degradation of user experience, disruption to our production systems, and destruction or manipulation of any data on ISACA systems.
  4. Limit the use of discovered exploit(s) to the extent necessary to confirm a vulnerability’s presence.
  5. Not to use an exploit to compromise or exfiltrate any data, obtain command line access and/or persistence, or use the exploit to laterally traverse to other ISACA systems.
  6. Not to use ISACA as a launch pad to attempt intrusions on non-ISACA systems.
  7. Implant any external code, or data even if considered non-malicious, on ISACA systems.
  8. Do not attempt to “phish” or use other social-engineering methods on ISACA personnel.
  9. Provide ISACA a reasonable amount of time to resolve the issue before you disclose it publicly.
  10. Do not submit repetitive reports or high volume of low-quality vulnerability reports.

Scope:
The ISACA VDP program only applies to the following target domains:
*.soongshinkid.com
*.cmmiinstitute.com

Subdomains, domains and third-party integrations NOT in scope include:
Any dev.*.*, stage.*.*, UAT.*.* and SIT.*.*
Jobs.soongshinkid.com
Engage.soongshinkid.com

What we expect:
In order to help us triage and prioritize submissions, we require that your submission:

  • Describe in as much detail how the vulnerability was discovered and the potential impact of exploitation.
  • Instructions to reproduce the vulnerability. This should include step-by-step instructions or screenshots.
  • All Reports must be in English language.

Limitations:
If you established that a vulnerability or security weakness exists or encounter any sensitive data or data belonging to individuals with their personal or financial information, contract information or proprietary information which might be a trade secret, you must stop your test, notify ISACA immediately, and not disclose this data to anyone else. ISACA will not consider this as authorized research and may report it to applicable authorities.

Awards:
ISACA, at its sole discretion, may decide to “reward” a researcher in ways it deems commensurate with ISACA’s determination of the value of the received vulnerability report.

The reward can be in any form as decided by ISACA and may include cash, company swag or gifts. All rewards are subject to various city, state, country and other laws and regulations that are applicable to ISACA and may not be awarded at all under certain conditions.

Thank you for contributing to Information security program responsibly!