Vulnerability handling requirements
Vulnerability handling requirements mandate that manufacturers establish and maintain a systematic process to identify, report, and remediate security vulnerabilities in products with digital elements throughout their lifecycle. This includes coordinating with external researchers and notifying relevant EU authorities of actively exploited vulnerabilities.
What it means
The intent is to minimize the window of exposure between the discovery of a flaw and the deployment of a fix. Manufacturers cannot simply release a product; they must maintain an active "security posture" that assumes flaws will be found after the product is in the hands of users.
In practice, this requires a closed-loop system: a way for vulnerabilities to be reported (internally or externally), a method to assess their risk (triage), a process to develop and deploy updates, and a mechanism to inform users of risks and available fixes.
This requirement extends beyond internal QA. It encompasses the "coordinated vulnerability disclosure" ecosystem, meaning manufacturers must provide a clear path for security researchers to report flaws without fear of legal retaliation, provided they follow the established policy.
How to meet it
- Publish a Vulnerability Disclosure Policy (VDP) that clearly explains how external parties can report vulnerabilities and what the manufacturer's response timeline is.
- Establish an internal vulnerability management workflow to triage reports, assign severity levels (e.g., using CVSS), and track remediation progress.
- Implement a secure mechanism for delivering over-the-air (OTA) or manual security updates to users without compromising other system functions.
- Create a reporting pipeline to notify the European Union Agency for Cybersecurity (ENISA) or relevant national authorities of any actively exploited vulnerabilities as required by the Regulation.
- Develop a communication template for issuing security advisories to customers, ensuring they are informed of the risk and how to apply the fix.
- Maintain an inventory of third-party components (SBOM) to monitor for upstream vulnerabilities that affect the product.
Evidence an auditor asks for
- The public-facing Vulnerability Disclosure Policy (VDP).
- A vulnerability tracking log or Jira board showing the lifecycle of a flaw from report/discovery to resolution and verification.
- Records of security updates released, including version numbers and descriptions of the vulnerabilities addressed.
- Documentation of the process used to notify EU authorities of critical or exploited flaws.
- Examples of security advisories sent to end-users.
Common pitfalls
- Lack of a formal intake channel, leading to reports being ignored or lost in general support tickets.
- Failure to define "criticality," resulting in low-risk bugs being prioritized over high-risk vulnerabilities.
- Neglecting the reporting obligation to EU authorities, focusing only on fixing the bug and notifying the customer.
- Having a patching process that is too cumbersome for users, leading to low adoption rates of critical security updates.