An agency's VDP must include, at a minimum: a scoping statement naming the systems it covers; details for making contact; options for communicating securely, including any public keys; the information finders should put in a report; a commitment to acknowledge reports, with a response time; guidance on which forms of vulnerability testing reporters or finders may not undertake (permitted activities); an agreement by reporters or finders to keep the vulnerability confidential until the disclosure period ends, so the agency can fix issues before they become public; a statement that illegal activity is not allowed, naming the applicable legislation (for example the Crimes Act); and either a statement that no bug bounties will be paid for findings, or details of the bug bounty programme the agency runs.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.