 Finally, we urge states to take a holistic approach to supply chain risk management, working to help all stakeholders mitigate risks to security and integrity not just at the procurement stage but also through strong internal controls, such as those related to configuration management, segregation of duties, change management, and access management. Moreover, given that supply chains regularly span multiple countries states should actively promote and encourage other states in securing their parts of the supply chain. This could be done by regular state-to-state dialogues but also by encouraging information exchange and capacity building in the private sector. (j) States should encourage responsible reporting of ICT vulnerabilities and share associated information on available remedies to such vulnerabilities to limit and possibly eliminate potential threats to ICTs and ICTdependent infrastructure; Australian Strategic Policy Institute, International Cyber Policy Centre Global Partners Digital  Implementation of norms are demonstrated by states’ actions, capabilities, and strategic policy direction. As this norm deals with States’ efforts to encourage responsible reporting of ICT vulnerabilities, examples of implementation include: - States acknowledge and endorse public vulnerability reporting policies for, and by, government and non-governmental organisations - States accept the practice of legitimate bug bounty programmes engaging private sectors, cyber security industry and security researchers - States establish a vulnerability equities processes that guides decision-making by their sovereign cyber capabilities - States endorse relevant ISO standards and, for instance, the GFCE global good practises on CVD. - States provide adequate legal provisions to support, encourage and protect responsible reporters. - States organise hacking sessions, like Indonesia’s “Everybody can hack” or the US’ “Hack the Pentagon” competition.  Responsible reporting of ICT vulnerabilities, which in some cases have been the main mechanism for conducting cyber operations, is essential for maintaining a peaceful and secure cyberspace. As the use of shared ICT systems, including as a result of the spread of connected devices, continues, the existence of ICT vulnerabilities and the need to address them in a timely manner grows in urgency.  Due to the varied equities and responsibilities of stakeholders with regards to vulnerability reporting,liv states should recognise and institute disclosure processes that recognise that vulnerability reporting is a multistakeholder effort and thus engage all stakeholders in both the development and implementation of vulnerability disclosure processes.  States should make public the criteria and processes used in determining whether the government discloses a vulnerability they have discoveredlv and should codify government disclosure processes into law to ensure compliance.lvi  In addition, states should set up coordinated vulnerability disclosure processes,lvii to engage all stakeholders in vulnerability reporting, in accordance with the guidelines and recommendations defined in ISO/IEC 29147:2014 and ISO/IEC 3011.lviii  In particular, best practice guidance highlights the importance of both protecting and incentivising the work of security researchers. To this end, national legislation should be amended to protect security researchers and provide them with legal certainty in reporting vulnerabilities.lix  Complementary best practice programmes which states can promote to raise awareness of the importance of disclosure and to incentivise disclosure of vulnerabilities include the promotion of “safe harbor policies”,lx and “bug bounty programmes”.lxi States should also fund defensive vulnerability discovery and research and invest in building security researcher communities. ICRC & Australian Red Cross  The preferred option for enhancing the safety of cyber space should be disclosing vulnerabilities to the appropriate software developer or vendor so that the vulnerabilities can be fixed.lxii In this regard, we welcome the fact that the Australian Signals Directorate (ASD) has adopted Responsible Release Principles for Cyber @DFAT DFAT.GOV.AU