Coordinated Vulnerability Disclosure Policy
Xovis (also referred to herein as the “Company”) has established a formal process for the receipt, evaluation, coordination, remediation, and communication of product security vulnerability reports. The process applies to products incorporating digital elements and contributes to the fulfillment of regulatory requirements, in particular those deriving from the Cyber Resilience Act and the NIS2 context.
Scope
This policy applies to security vulnerabilities in products with digital elements, including embedded software, firmware, and relevant third-party components, for which Xovis is accountable for product-related assessment and coordination.
Normative Basis
Xovis’ Coordinated Vulnerability Disclosure (CVD) Policy is based on the following requirements and recommendations:
Cyber Resilience Act (EU) 2024/2847, in particular the requirements for Vulnerability Handling and coordinated disclosure
NIS2 Directive (EU) 2022/2555 and the context of its implementation in Germany
The requirements deriving from Xovis’ governance, compliance, and information security management
The Company’s CVD policy stipulates the single point of contact for report submission as well as the procedures for report triage and remediation, thus providing the governance basis for product vulnerability management.
Vulnerability Reporting Office
Xovis designates the following contact point for the receipt of product vulnerability-related reports and inquiries: support@xovis.com. The contact point is considered the first point of entry for receipt of vulnerability reports.
Minimum Requirements for Handling Reports
The following steps are required for handling reports:
Receipt of reports and registration
Determination of scope and security relevance
Assignment to the responsible party for elaboration and remedy
Escalation of confirmed relevant reports
Implementation of traceability and documentation controls
Evaluation and Prioritization
The report will be evaluated for technical validity and business impact. In particular, the following criteria will be considered:
Impacted products and versions
Vector of attack and complexity
Impact on confidentiality, integrity, availability, and authenticity
Exploitability and public availability of exploit code
Compensating measures
Impact on installed base and customers
Involvement of third-party components
Relevance for regulatory or contractual reporting
Safe Harbor
The Company supports the responsible disclosure of product security vulnerabilities and will not resort to civil law remedies or provide information to criminal authorities for reports submitted in good faith, in particular following the procedure stipulated by this policy and without the intention to damage the Company’s systems, data, or services.
This safe harbor protection does not extend to acts aimed at directly damaging the Company’s products, services, or systems or unlawful accessing or processing of personal data, which may constitute crimes under criminal law and/or data privacy laws.
Remediation and Corrective Measures
Confirmed vulnerabilities will be remediated through product development and maintenance processes, including the implementation of code correction, hardening measures, firmware and/or software updates, compensating measures, and customer communication, as applicable. In cases where prompt remediation is not possible, the residual risk resulting from the vulnerability will be documented and considered.
Communication and Disclosure
The Company will implement a coordinated disclosure policy, which will ensure that public disclosure of a vulnerability is provided in a manner that appropriately balances the interests of all parties involved. This includes, in particular, ensuring that disclosure occurs after appropriate countermeasures are available or are sufficiently developed and documented, thus limiting the exposure of users to potential adverse effects.
The Company may choose to withhold disclosure in the event that such a decision is justified, in particular in order to minimize the adverse impact on customers and other stakeholders. In such cases, the reasons for the decision not to disclose must be documented.
Third-Party Components
In the case of third-party components incorporated in Xovis products, their impact on the affected products will be assessed, and remediation measures will be taken in accordance with the instructions from the component supplier, as applicable. Manufacturer notes or advisories in the context of a vulnerability affecting a particular component will be published if required.
Documentation and Transparency
Xovis’ procedures for demonstrating conformity with the requirements of the Cyber Resilience Act and NIS2, in particular the traceability of the vulnerability handling process, include the following elements:
Receipt of report and initial assessment, including determination of scope and technical assessment for relevance
Technical assessment, including determination of technical relevance and severity
Assignment of responsibility
Remediation and mitigation measures
Evidence of advisory, update release, or escalation
Based on the above, the CVD Policy incorporates the required controls for the reporting, processing, disclosing, and documenting of product security vulnerability reports in accordance with the normative basis.
Security Contact Point
For inquiries related to product security vulnerability, please contact the following Xovis Group mailbox: support@xovis.com.