Handle and remediate vulnerabilities throughout the support period

Once you find a security bug you must fix it fast. How fast depends on how bad the bug is. Assign a CVE ID. Tell users. Publish a security note. Do this for the whole time you support the product — not just at launch.

Legal text

Article 13(10) of Regulation (EU) 2024/2847, read with Annex I Part II, requires that manufacturers shall handle vulnerabilities effectively. The annex specifies the following concrete requirements:

Annex I Part II — Vulnerability handling requirements:

Identify and document vulnerabilities and components in the product (SBOM)
Address vulnerabilities without delay, proportionate to risk
Apply effective and regular security updates
Use CVE identifiers (from a CVE numbering authority) for vulnerabilities
Publish information about fixed vulnerabilities, including CVSS score
Adopt a coordinated vulnerability disclosure policy
Make it easy for third parties to report vulnerabilities
Share information on vulnerabilities with CSIRT network and ENISA upon request

Key requirements

Vulnerability management process — documented intake, triage, remediation, and disclosure workflow
Timely remediation — response time proportionate to CVSS score and exploitability
CVE assignment — obtain CVE IDs from a CNA (CVE Numbering Authority); ENISA operates as the EU CNA for CRA-related CVEs
CVSS scoring — publish CVSS (v3.1 or later) score with security advisories
Security advisories — publish advisories for all fixed vulnerabilities
End-of-support notice — notify users no later than 12 months before support ends so they can make alternative arrangements

Evidence you may need

Vulnerability management policy and SLA targets (time-to-patch by severity)
Vulnerability tracker or backlog
CVE assignment records
Published security advisories with CVSS scores
End-of-support notification records