OIG Audit Finds Commerce Department's VDP Ineffective

The Office of Inspector General (OIG) conducted an audit revealing that the Commerce Department's vulnerability disclosure program (VDP) is 'not fully effective' in securing its public-facing IT systems. This program was established to comply with a directive from the Cybersecurity and Infrastructure Security Agency (CISA). The audit identified several shortcomings in the department's approach to vulnerability disclosure and remediation.