What should you report?
The main information you need to share with external stakeholder is a list of actively exploited vulnerabilities.
To whom?
1 - Reporting to the European Agency
Notifying the European Union Agency for Cybersecurity (ENISA) about actively exploited vulnerabilities is imperative and must occur within 24 hours of becoming aware of the vulnerability. This reporting should include detailed information about the exploit and any measures taken to address or mitigate its effects.
In the context of the Cyber Resilience Act, the ENISA organization is tasked with receiving notifications from OEMs regarding actively exploited vulnerabilities in their products as well as incidents impacting the security of these products. It should transmit these notifications to relevant European & States authorities
2 - Reporting to users
Additionally, device makers should promptly inform users of any security incidents affecting their products, along with any corrective measures that users can implement to mitigate the impact.
This proactive reporting ensures that users can respond swiftly to security incidents, whether through published information on the manufacturer’s website or direct outreach from the manufacturer.
Equipment manufacturers ought to autonomously establish the appropriate timing for notifying users, encompassing both patch releases and vulnerability identification. This schedule should align seamlessly with the outcomes of the risk assessment they have performed.
