Scope of vulnerability management
Article 32
This Chapter applies to ICT products for which an EUCC certificate was issued.
Commission Implementing Regulation (EU) 2024/482 CHAPTER VI — VULNERABILITY MANAGEMENT AND DISCLOSURE
Compiled from an official source version. Later amendments or repeals may not be reflected; the official text prevails. · Read the official text ↗
SECTION I — Vulnerability management
Vulnerability management procedures
Article 33
1. The holder of an EUCC certificate shall establish and maintain all necessary vulnerability management procedures in accordance with the rules laid down in this Section and, where necessary, supplemented by the procedures set out in EN ISO/IEC 30111. 2. The holder of an EUCC certificate shall maintain and publish appropriate methods for receiving information on vulnerabilities related to their products from external sources, including users, certification bodies and security researchers. 3. Where a holder of an EUCC certificate detects or receives information about a potential vulnerability affecting a certified ICT product, it shall record it and carry out a vulnerability impact analysis. 4. When a potential vulnerability impacts a composite product, the holder of the EUCC certificate shall inform the holder of dependent EUCC certificates about potential vulnerability. 5. In response to a reasonable request by the certification body that issued the certificate, the holder of an EUCC certificate shall transmit all relevant information about potential vulnerabilities to that certification body.
Vulnerability impact analysis
Article 34
1. Vulnerability impact analysis shall refer to the target of evaluation and the assurance statements contained in the certificate. Vulnerability impact analysis shall be carried out in a timeframe appropriate for the exploitability and criticality of the potential vulnerability of the certified ICT product. 2. Where applicable, an attack potential calculation shall be performed in accordance with the relevant methodology included in the standards referred to in Article 3 and the relevant state-of-the-art documents listed in Annex I, in order to determine the exploitability of the vulnerability. The AVA_VAN level of the EUCC certificate shall be taken into account.
Vulnerability impact analysis report
Article 35
1. The holder shall produce a vulnerability impact analysis report where the impact analysis shows that the vulnerability has a likely impact on the conformity of the ICT product with its certificate. 2. The vulnerability impact analysis report shall contain an assessment of the following elements: (a) the impact of the vulnerability on the certified ICT product; (b) possible risks associated with the proximity or availability of an attack; (c) whether the vulnerability may be remedied; (d) where the vulnerability may be remedied, possible resolutions of the vulnerability. 3. The vulnerability impact analysis report shall, where applicable, contain details about the possible means of exploitation of the vulnerability. Information pertaining to possible means of exploitation of the vulnerability shall be handled in accordance with appropriate security measures to protect its confidentiality and ensure, where necessary, its limited distribution. 4. The holder of an EUCC certificate shall transmit a vulnerability impact analysis report to the certification body or the national cybersecurity certification authority in accordance with Article 56(8) of Regulation (EU) 2019/881, without undue delay. 5. Where the vulnerability impact analysis report determines that the vulnerability is not residual within the meaning of standards referred to in Article 3, and that it can be remedied, Article 36 shall apply. 6. Where the vulnerability impact analysis report determines that the vulnerability is not residual and that it cannot be remedied, the EUCC certificate shall be withdrawn in accordance with Article 14. 7. The holder of the EUCC certificate shall monitor any residual vulnerabilities to ensure that it cannot be exploited in case of the changes in the operational environment.
Vulnerability remediation
Article 36
The holder of an EUCC certificate shall submit a proposal for an appropriate remedial action to the certification body. Certification body shall review the certificate in accordance with Article 13. The scope of the review shall be determined by the proposed remediation of the vulnerability.
SECTION II — Vulnerability disclosure
Information shared with the national cybersecurity certification authority
Article 37
1. The information provided by the certification body to the national cybersecurity certification authority shall include all elements necessary for the national cybersecurity certification authority to understand the impact of the vulnerability, the changes to be made to the ICT product and, where available, any information from the certification body on the broader implications of the vulnerability for other certified ICT products. 2. The information provided in accordance with paragraph 1 shall not contain details of the means of exploitation of the vulnerability. This provision is without prejudice to the investigative powers of the national cybersecurity certification authority.
Cooperation with other national cybersecurity certification authorities
Article 38
1. The national cybersecurity certification authority shall share the relevant information received in accordance with Article 37 with other national cybersecurity certification authorities and ENISA. 2. Other national cybersecurity certification authorities may decide to further analyse the vulnerability or, after informing the holder of the EUCC certificate, request the relevant certification bodies to assess whether the vulnerability may affect other certified ICT products.
Publication of the vulnerability
Article 39
Upon withdrawal of a certificate, the holder of the EUCC certificate shall disclose and register any publicly known and remediated vulnerability in the ICT product on the European vulnerability database, established in accordance with Article 12 of Directive (EU) 2022/2555 of the European Parliament and of the Council ( 5 ) or other online repositories referred to in Article 55(1), point (d) of Regulation (EU) 2019/881.
Back to Commission Implementing Regulation (EU) 2024/482 — full text
Articles on this page are reproduced verbatim from official open data. See the attribution line.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
What to look at next
Commission Implementing Regulation (EU) 2024/482, full textChapter navigation and full text, so you can read this section in contextEuropean Union legislationEU Legal Acts by type and yearGrouped by instrument type and year of enactment, so you can find others of the same kindBrowse by type and yearEuropean Union: what this database coversWhich datasets are here, which official source they come from, and how current they areEuropean Union overview