Vulnerabilities: what the manufacturer must deliver over time

The requirements

Record components in an SBOM, remedy vulnerabilities without delay, provide security updates free of charge – separately from functional updates where possible –, test regularly and publish fixed vulnerabilities.

Coordinated disclosure

The manufacturer sets up a policy on coordinated vulnerability disclosure and provides a contact address through which third parties can report vulnerabilities. This information also belongs in the information for users.

Actively exploited vulnerabilities

Then the reporting obligations apply: early warning within 24 hours, notification within 72 hours, a final report – via ENISA's platform.