Security risks and vulnerabilities should not be made public. Aren there confidentiality issues with verification and reporting of security?
This is a legitimate concern. The last thing ACC wants is to create a roadmap to sites that pose risks to the public. Prioritization results and vulnerability assessments must be kept confidential, and will not be reported to ACC. Third party verification would only encompass verification that appropriate security measures to which a site commits are in place.
