Resolves #103, Explicit requirement for inclusion of agency OGC in policy development

[egyptiankarim]

The pull request adds a requirement that agencies consult their legal folks regarding any assertions related to pursuit of legal action made in their vulnerability disclosure policies.

As BODs tend to lean "techy" and will likely initially land amongst OCIO types, there may be value in explicitly requiring agencies work with their legally-minded organizations as they develop their vulnerability disclosure policies.

This pull requests resolves #103, Explicit requirement for inclusion of agency OGC in policy development.

[h-m-f-t]

Thanks for this!

Just to be clear, we're not actually merging PRs, but we will evaluate all changes suggested.

[konklone]

Just to be clear, we're not actually merging PRs, but we will evaluate all changes suggested.

Even without literally merging the PR, it's still possible to use GitHub/git to link changes to individual PRs and commits. For an example of this, see: GSA/https#108

[egyptiankarim]

Yeah, I think that “resolves” works as a keyword like “fixes” for the same purpose. https://help.github.com/en/github/managing-your-work-on-github/closing-issues-using-keywords#about-issue-references

[h-m-f-t]

Even without literally merging the PR, it's still possible to use GitHub/git to link changes to individual PRs and commits. For an example of this, see: GSA/https#108

Definitely. And I should have been more clear in my attempt at clarity: we're not merging PRs now. 🇺🇸

[h-m-f-t]

Closing in favor of #152.

In general, what @egyptiankarim outlined is what's expected in practice for agencies. M-20-32 does make those points more explicit, though:

Each Federal agency's chief information security officer (CISO), or equivalent senior official of a different title is responsible for implementing the policies described in this memorandum. This official shall work with the senior agency official for privacy (SAOP), chief data officer (CDO), general counsel (GC), and other relevant agency officials to ensure compliance with applicable laws, regulations, and policies.