NIST CSF 2.0, IdentifyID.RA-08

Publish a means for a security issue affecting the device to be reported to the manufacturer, and provide status updates on the resolution of a reported issue.

Provide a dedicated, securely reachable channel, such as an HTTPS web form or a PGP-encrypted email address, for a customer, end user, or third party to report a security vulnerability, and publish a coordinated vulnerability-disclosure policy on your website covering how you want to be notified, what a reporter should expect, and your process's scope and limits.

From 11 December 2027 (Article 71(2)), when you identify a vulnerability in a component integrated in your product, including an open-source component, report the vulnerability to the person or entity manufacturing or maintaining the component and address and remediate it under the vulnerability handling requirements of Annex I, Part II. If you developed a software or hardware modification to address the vulnerability, share the relevant code or documentation with that person or entity, where appropriate in a machine-readable format (Article 13(6)).

Put in place a coordinated vulnerability disclosure policy and a contact channel for reporting a vulnerability, and disclose the end date of the support period to the buyer at the time of purchase.

It reaches you if you hold an EUCC certificate for an ICT product issued under the European Common Criteria-based cybersecurity certification scheme; Chapter VI applies to ICT products for which an EUCC certificate was issued (Article 32). Establish and maintain all necessary vulnerability management procedures in accordance with Chapter VI, supplemented where necessary by the procedures set out in EN ISO/IEC 30111 (Article 33(1)).

Maintain and publish appropriate methods for receiving information on vulnerabilities related to your products from external sources, including users, certification bodies and security researchers (Article 33(2)).

As a manufacturer, keep for each device a procedure for handling an incident or vulnerability that a user finds, documenting its nature, giving detailed instructions for dealing with it and listing mitigation measures (Article 39).

Publish at least one point of contact for reporting a security issue affecting the product, in English, free of charge, without requiring the reporter's personal information, and state when the reporter will get an acknowledgment and status updates.

If ACN notifies you of a specific vulnerability you are exposed to, as an entity in Article 1(1), a national cybersecurity perimeter entity or an electronic communications provider under Article 40(3) of the Electronic Communications Code, apply the remedies it indicates without delay and within 15 days of its notice, unless technical or organisational reasons you have promptly communicated to ACN prevent it (Article 2).

Once the competent cyber incident prevention institution relays a substantiated report that a vulnerability exists in a system or network you operate, remediate it within the deadline the institution sets, no later than 90 days from when you received the information.

Report your remediation progress to the institution as you go, and, if you cannot remediate within 90 days for objective reasons, request an extension, which the institution may grant up to a total of 180 days from the report's submission.

Address without undue delay the vulnerabilities you identify as critical to your operations, and lay down a procedure for disclosing vulnerabilities in accordance with the applicable national coordinated vulnerability disclosure policy (points 6.10.2(c) and (e)).