Vulnerability Management/CVD

Under the CRA, manufacturers must establish a reporting process (Coordinated Vulnerability Disclosure, CVD) for vulnerabilities. This is intended to enable external researchers and security experts to report discovered security vulnerabilities confidentially to the manufacturer, who in turn must ensure that they are addressed in a timely manner.

Companies must therefore implement all steps of the CVD process from both a technical and organizational perspective. This involves numerous individual tasks. For example, a platform for receiving reports must be set up, and incoming reports must be assessed for their relevance and criticality. If necessary, immediate measures must be taken to secure systems or to report data breaches to regulatory authorities and affected parties. The report must be forwarded internally to the responsible product or service managers. The CRA also requires companies to address known vulnerabilities.

Patches or configuration changes must be created, tested, and delivered to customers or implemented in the company’s own cloud services. Furthermore, the company must maintain continuous communication with the reporters and, if necessary, other affected stakeholders. Ideally, the remediation of the vulnerability is followed by a review of the company’s own development and quality assurance processes to prevent similar gaps in the future.

Fraunhofer SIT supports companies in establishing appropriate processes and advises on every aspect of a successful CVD process. Our experts are happy to assist you, whether you need to optimize an existing process in light of the CRA or set up a completely new process. Just give us a call or send an email!