This discussion would be a reflection of past public, good and bad, disclosures based on past experiences and data collected by CISA. It would also attempt to highlight vendor disclosure policies, software development lifecycles and describe common asset owner patching cycles from the industrial control system perspective in comparison to researcher disclosure policies.