Cyber vulnerability disclosure policies for the smart grid

As smart grid technologies become more widely deployed, an increasing number of cyber vulnerabilities will be found throughout the supporting systems. While the traditional IT industry has a long history of dealing with vulnerability disclosures, however, recent discoveries within control system software have shown the power industry still lacks sufficient polices and approaches. This paper introduces current vulnerability disclosure methods, including full disclosure, limited disclosure, and non-disclosure. It then provides a comparison of disclosure policies by both vendors and disclosure coordinators. Finally, it addresses industry specific characteristics which may impact domain-specific disclosure policies and identifies requirements for improving disclosure methods.