Product cybersecurity

Information security and data protection are more important than ever, especially the security of our products. As a manufacturer, we appreciate all reports submitted by stakeholders that help us identify and resolve potential security issues in our products.

These responsible disclosure guidelines set out our policy and our commitment regarding the reporting of security issues, such as exploited vulnerabilities or serious security incidents affecting our products.

Our Product Security Incident Response Team (PSIRT) receives all reported security issues, coordinates communication both internally and externally, and ensures that security updates or other solutions are provided.

Scope

These guidelines apply to all products with digital elements, both hardware and software. Please report any anomalies that could indicate the exploitation of a potential vulnerability.

These guidelines do not apply to other incidents affecting the functional safety or availability of our products. In such cases, please contact our service partners first. Nor do they apply to digital services that are not directly related to our products.

Guidelines for the responsible handling of vulnerabilities

• Report security issues immediately to our central point of contact for vulnerability information. Please also report cases where a security issue is suspected but cannot yet be clearly identified.
• Provide us with all information that could help us reproduce and isolate the reported security issue or suspected case.
• Treat security issues confidentially and leave any further communication to us in accordance with legal requirements. Give us the opportunity to address security issues as quickly as possible, and do not disclose information about them to third parties without our consent.

Process

Reported vulnerabilities are handled according to a standardized process documented in our management system. It covers everything from the receipt of a report of exploited vulnerabilities or serious security incidents, through their comprehensive analysis, any necessary notifications to the authorities and the provision of corrective measures, to the preparation of a detailed final report.