NIST CSF 2.0, ProtectPR.PS-02

Publish, before supply, the period including an end date for which the device will receive security updates, provide or supply the product with a statement of compliance with the security standard, and retain a copy of that statement for five years.

Publish a clear support policy stating how long and in what circumstances you will provide security updates, and provide security updates free of charge for at least 2 years after the product's launch or for as long as you keep distributing it to consumers, whichever period is longer.

Maintain a public, Portuguese-language support page listing known vulnerabilities in your products together with their mitigations, and keep making corrected software or firmware available.

Stop using a technology that a Council of Ministers decree restricts under Article 27(1) within three years of the decree's adoption, or within the shorter period the decree sets where the risk to national security is high (Article 27(2)).

On discovering a security defect, vulnerability, or other risk in your product or service, immediately take remedial measures, notify affected users as provided, and report the defect or vulnerability to the competent authority; the statute states no numeric clock for this notice, only immediacy.

Provide continuous security maintenance for your product or service and do not terminate it within the period fixed by regulation or agreed with your user.

Maintain a support period of at least five years, or the product's expected use time if shorter, handle vulnerabilities in the product and its components throughout that period, and keep each security update available for ten years after release or for the remainder of the support period, whichever is longer.

Put in place a coordinated vulnerability disclosure policy and a contact channel for reporting a vulnerability, and disclose the end date of the support period to the buyer at the time of purchase.

It reaches you if you place a server or an online data storage product on the market (Article 1(1)); the Regulation does not apply to servers intended for embedded applications, small scale servers, servers with more than four processor sockets, server appliances, large servers, fully fault tolerant servers, network servers, small data storage products or large data storage products (Article 1(2)). Make the latest available version of the firmware available, free of charge or at a fair, transparent and non-discriminatory cost, from two years after the placing on the market of the first product of a model and for a minimum period of eight years after the placing on the market of the last product of that model (Annex II, point 1.2.3, applying from 1 March 2021 under Article 3).

Make the latest available security update to the firmware available, free of charge, from the time a product model is placed on the market until at least eight years after the placing on the market of the last product of that model (Annex II, point 1.2.3).

It reaches you if you are the manufacturer, importer or authorized representative of a smartphone, a mobile phone other than a smartphone or a slate tablet that you place on the market (Article 1(1)); the Regulation does not apply to mobile phones and tablets with a flexible main display that the user can unroll and roll up, or to smartphones for high security communication (Article 1(2)). If you provide security updates, corrective updates or functionality updates to the operating system of a product model, make them available at no cost for all units of that model from the date of end of placement on the market to at least 5 years after that date, whether you offer them voluntarily or provide them to comply with Union law (Annex II, Part A point (6), Part B point (6), Part D point (5)).

Make security updates and corrective updates available to the user at the latest 4 months after the public release of the source code of an update of the underlying operating system or, if the source code is not publicly released, after an update of the same operating system is released by the operating system provider or on any other product of the same brand (Annex II, point (6)(c) or (5)(c)).

Provide the consumer, during the relevant period, with the updates needed to keep the digital product in conformity with the contract, including security updates, and inform the consumer about them (Section 327f(1)).

If you sell goods with digital elements to a consumer in Portugal, ensure that the updates, including security updates, needed to keep the goods in conformity are communicated and supplied to the consumer for the period the consumer could reasonably expect; for a continuous supply, the period is two years where the supply lasts up to two years and the duration of the contract where it lasts longer (Article 8(1) to (3)).

If you supply digital content or a digital service to a consumer in Portugal, ensure that the updates, including security updates, needed to keep it in conformity are communicated and supplied to the consumer for the period the consumer could reasonably expect where the contract provides one act or a series of acts of supply, and for the whole period of supply where it provides a continuous supply (Article 29(3) and (4)).

If you sell goods with digital elements to a consumer in Romania, ensure that the consumer is informed about updates and is supplied with the updates, including security updates, needed to keep the goods in conformity, for the period the consumer can reasonably expect where the sale contract provides a single act of supply of the digital content or service (Article 6(3)(a)).

Where the sale contract provides continuous supply of the digital content or service over a set period, supply those updates for the periods in Article 9(3) and (4): two years from delivery for goods with an average period of use of up to five years, five years from delivery for goods with a longer average period of use, and the contractual supply period where it exceeds five years (Article 6(3)(b)).

Apply patches in a controlled and timely way across your technology environment to address vulnerabilities and flaws.

Apply security patches within a reasonable time after they become available and test them before applying them in production systems, unless you document and substantiate a decision that the disadvantages of applying a patch outweigh the cybersecurity benefits (points 6.6.1 and 6.6.2).

Develop, document and implement vulnerability management procedures that identify trustworthy information resources, perform automated vulnerability scanning and assessments (at least weekly for the ICT assets supporting critical or important functions), verify that ICT third-party service providers handle vulnerabilities and report at least the critical ones, track third-party and open-source libraries used by ICT services supporting critical or important functions, establish procedures for the responsible disclosure of vulnerabilities to clients, counterparties and the public, and prioritize the deployment of patches (Article 10(1) and (2)). Develop, document and implement patch management procedures that identify emergency procedures and set deadlines for installing patches and updates with escalation procedures in case those deadlines cannot be met (Article 10(3) and (4)).

The Department says you should consider whether to strengthen operational resilience by replacing end-of-life or legacy information systems.

The Department says you should consider expeditiously identifying and remediating known exploited vulnerabilities in firmware, hardware and software, especially on systems exposed to the Internet; disabling inactive or unnecessary ports and protocols where possible; establishing network access protections and segmenting networks; and reviewing and validating cloud application configurations against your risk tolerance.