Having this policy within a company means that whomever signs the nondisclosure agreement agrees to keep the vulnerability information within that organization tightly contained so that no one outside of the organization, especially the general public, ever learns of the existence of product vulnerabilities.