Forcepoint Network Security
Advance Notice Policy

Purpose
Forcepoint recognizes that Product release dates known in advance allow operational teams to plan and schedule maintenance windows more effectively. Forcepoint also recognizes that, in relation to vulnerabilities, the period of highest risk to customers may not always be the period before the release with the fix is made available but rather the interval between such release availability and when the customer can install it. To allow customers to shorten that interval and mitigate associated risk, Forcepoint has published this Advance Notice Policy for the Network Security Platform, Security Engine (“Product”). This Policy is designed to provide customers with greater insight into upcoming Product releases to facilitate more responsive installation of Critical severity vulnerability fixes.

Scope
This Policy provides insight into how Forcepoint endeavors to communicate advance notices for certain releases of the Product, that contain a Critical severity vulnerability fix.  This Policy does not apply to other Forcepoint products. Forcepoint may revise this Policy, including the severity threshold and the notice interval, at any time.

1.    What an advance notice is
An advance notice communicates the upcoming availability of a scheduled Product release that contains a fix for a vulnerability deemed by Forcepoint to be Critical severity, before the Product release is made available.

2.    When an advance notice is published
Forcepoint will endeavor to communicate the advance notice when the scheduled Product release contains a fix for a vulnerability deemed by Forcepoint to be Critical severity.  Product releases with fixes for vulnerabilities not deemed Critical severity by Forcepoint may be made available without an advance notice.  The security fixes in such a release are documented in a Forcepoint security advisory issued when the release becomes available, where Forcepoint deems the information necessary to assess the urgency of installing the release. 
Forcepoint determines the severity of a vulnerability in relation to the Common Vulnerability Scoring System 4.0 (CVSS). However, Forcepoint may determine a vulnerability is above or below its CVSS band where it deems reasonably appropriate to do so in light Product specific context that the CVSS calculation does not capture (e.g., the practical impact on customers). Whether a vulnerability is deemed Critical severity and an advance notice is communicated are therefore at Forcepoint’s reasonable discretion, which may not always match a direct calculation of the CVSS score.

3.    What an advance notice contains
The advance notice will state that a release is coming for a given version branch or several branches of the Product, the planned date of the release, and that the release contains a fix for a vulnerability deemed Critical severity by Forcepoint. Please note that the date specified in the advance notice represents indicative strategy and is Forcepoint's plan at the time of communicating the advance notice based on information then known to Forcepoint. All references to dates and features are subject to change. Unforeseen circumstances may require the release date to move, and Forcepoint will endeavor to communicate any such change promptly.
Forcepoint will also endeavor to include in the advance notice links to available Forcepoint knowledge base articles containing known global mitigation or workaround guidance, which will remain restricted to authenticated support portal users. However, Forcepoint must remain mindful that incomplete mitigation guidance and detailed advance notices may enhance the reach of malicious actors. As a result, customers should not expect the advance notice to include expected mitigation strategies or detailed information on the vulnerability, such as the affected component, attack vectors, and affected features. Such details, including impact, affected versions, and mitigation guidance, may be published in accordance with Forcepoint’s standard Product processes at the moment the Product release that includes the fix is made available.

4.    The notice interval
Forcepoint will endeavor to communicate the advance notice one week before the planned release of the Product that includes the fix. One week is designed to provide a customer's operational teams sufficient time to plan and schedule a maintenance window while minimizing delays.

5.    Delivery method
The advance notice will be sent by email to customers subscribed to Forcepoint Technical Alert notifications. The advance notice will also be posted in the Forcepoint Support Portal for authenticated users. To receive the advance alert as soon as possible, Forcepoint recommends that customers subscribe to Forcepoint Technical Alert notifications.

6.    Releases without advance notice
In addition to Product releases with fixes for vulnerabilities not deemed Critical severity by Forcepoint, Forcepoint also retains the right to make available a Product release with a Critical severity fix without an advance notice as it deems necessary (e.g., when a vulnerability is being actively exploited). Forcepoint may determine that the benefits of promptly getting the fix to customers outweigh the benefit of a planned notice period.
As it deems necessary, Forcepoint may make available a hotfix build, which contains only a specific limited fix on top of the previous Product release version. A hotfix build is designed both to be installed without the full qualification effort that a more comprehensive release installation requires and to carry less regression risk. Forcepoint will issue a security advisory and the corresponding knowledge base articles with the availability of such Product release or hotfix build in accordance with Forcepoint’s standard Product processes.