Dcc Smart Vulnerability Disclosure

generated: '2026-07-27'
method: searched
probe: true
source: https://www.smartdcc.co.uk/media/sn5dn4hr/information-security-policy-3.pdf
summary: >-
  Smart DCC publishes no RFC 9116 security.txt, no responsible-disclosure page and no bug
  bounty programme (HackerOne, Bugcrowd and Intigriti were all checked and none was found).
  What it does publish is a board-level Information Security Policy, linked from the footer
  of every page, which names a Chief Information Security Officer as the accountable owner
  and gives a monitored security mailbox. That mailbox is the only published route for
  reporting a security concern.
policy:
- https://www.smartdcc.co.uk/media/sn5dn4hr/information-security-policy-3.pdf
contact:
- informationsecurity@smartdcc.co.uk
security_txt: false
bug_bounty: null
programs_checked:
- {program: HackerOne, found: false}
- {program: Bugcrowd, found: false}
- {program: Intigriti, found: false}
- {path: /.well-known/security.txt, status: 404}
- {path: /security, status: 404}
- {path: /responsible-disclosure, status: 404}
evidence:
- source: https://www.smartdcc.co.uk/media/sn5dn4hr/information-security-policy-3.pdf
  kind: information-security-policy
  detail: >-
    Information Security Policy v5.4, next review November 2026. Sets out the DCC Board's
    accountability for information security, a RACI with the CISO accountable and the
    Security Function responsible, a Security Architecture Framework aligned to the NIST
    Cybersecurity Framework 2.0 and mapped to ISO/IEC 27001:2022, and an ISMS described in
    the DCC ISMS Manual. Policy exceptions are raised to informationsecurity@smartdcc.co.uk.
- source: https://www.smartdcc.co.uk/major-incident-management/
  kind: incident-transparency
  detail: >-
    Public monthly publication of all Category 1 incidents with a published definition and
    a stated 24/7 monitoring capability.
gaps:
- No /.well-known/security.txt (RFC 9116)
- No published coordinated vulnerability disclosure policy or safe-harbour statement
- No bug bounty or VDP platform listing