Vulnerability Disclosure policy

1. Purpose and Scope

1.1 Purpose

DEIF A/S is committed to the security of our products and to working openly with the security research community and our customers when vulnerabilities are identified. This Vulnerability Disclosure Policy describes how to report security vulnerabilities in DEIF products, how we will respond, and how we work toward responsible resolution.

This policy is established in accordance with the provisions of the EU Cyber Resilience Act (Regulation (EU) 2024/2847).

By establishing this reporting channel, DEIF aims to detect and receive reports on vulnerabilities in our products at the earliest opportunity — enabling us to comply with our obligation to report actively exploited vulnerabilities to the relevant CSIRT and to ENISA, and to communicate remediation measures to affected customers and users.

1.2 Products in scope

This policy applies to all DEIF products with digital elements as defined under the EU Cyber Resilience Act, including:

• Controllers and PLCs, including those with network connectivity (Modbus TCP, and other communication interfaces)

• Protection relays, including those with embedded software or firmware

• Standalone DEIF software products, such as remote monitoring systems and configuration tools

• Other DEIF products incorporating software or firmware components

Products that contain no software, firmware, or digital processing components are outside the scope of this policy. Where the applicability of this policy to a specific product is uncertain, contact DEIF via security@deif.com.

1.3 Vulnerability types in scope

This policy covers:

• Vulnerabilities in DEIF proprietary firmware, software, or embedded systems

• Vulnerabilities in third-party components integrated into DEIF products where those vulnerabilities affect the security of the DEIF product

• Configuration weaknesses in default product configurations that could be exploited to cause harm

2. How to Report a Vulnerability

2.1 Reporting channel

Security vulnerability reports should be submitted to:

Email: security@deif.com

We accept reports in English and Danish. Reports in other languages will be processed on a best-effort basis.

2.2 What to include in your report

To allow us to evaluate your report and to comply with our duty to report on any actively exploited vulnerabilities detected, please include where possible:

• A description of the vulnerability and the affected DEIF product(s), firmware version(s), and communication interface(s)

• Step-by-step reproduction instructions sufficient for our security team to independently verify the issue

• A proof of concept - this may be a script, a packet capture, a screenshot, or any artefact that demonstrates the vulnerability exists (shared with DEIF for internal evaluation only; we will not share this without your permission)

• Your assessment of the potential impact

• Any suggested remediation or interim mitigations you are aware of

• Your name and contact details, if you wish to be acknowledged in our security advisory

3. What to Expect After Reporting

3.1 Acknowledgement

We will acknowledge receipt of your report within 3 business days of receiving it. Our acknowledgement will confirm that your report has been assigned to our security team for evaluation.

3.2 Evaluation and response

After acknowledging your report, we will:

1. Assess whether the report meets the reproducibility threshold described in Section 2.2

2. If the threshold is met, assign the report to our security team for technical evaluation

3. Assess vulnerability severity using CVSS as the primary assessment methodology

4. Provide you with an initial assessment within 10 business days of the report being admitted to our evaluation queue, including our severity rating and a target remediation timeline

5. Communicate any updates if the remediation timeline changes significantly

The 10-business-day assessment clock begins when the report is admitted to evaluation, not at acknowledgement of receipt.

For complex vulnerabilities requiring substantial engineering work, we may request a timeline extension. We will communicate any extension clearly and explain the reason.

3.3 Remediation and disclosure

Our target is to provide a security fix, firmware update, or documented workaround within 90 days of confirmed vulnerability validation. Shorter remediation timelines may be prioritised based on the assessed criticality of the vulnerability.

Once a fix is available, we will:

• Notify affected customers through our standard security advisory process

• Publish a security advisory at https://www.deif.com/deif-cybersecurity/security-advisories/

• Coordinate the public disclosure date with you, the reporter, where this has been requested

If we cannot meet the 90-day target for reasons outside our control, we will communicate this to you and agree a revised timeline. We will not request an embargo of more than 120 days from the date of confirmed validation without your agreement.

4. Coordinated Disclosure

DEIF follows a coordinated disclosure approach:

• We ask reporters to share vulnerability details with us before making any public disclosure, allowing time to develop and deploy a fix or interim mitigation

• We commit to providing a fix or documented mitigation before the agreed public disclosure date

• We will not take legal action against reporters who act in good faith under this policy, conduct their research within the scope described in Section 1, and do not access systems or data beyond what is necessary to demonstrate the vulnerability

• We will acknowledge reporters by name in the relevant security advisory, unless anonymity is requested

5. Out of Scope

The following are outside the scope of this policy:

• Vulnerabilities in third-party infrastructure not operated by DEIF (e.g. web hosting, cloud platforms)

• Denial-of-service attacks against DEIF systems or networks

• Social engineering of DEIF employees or contractors

• Physical security vulnerabilities in DEIF facilities

• Vulnerabilities in products that have reached their declared end-of-support date.

• Spam, phishing, or other non-technical security issues

6. DEIF’s Reporting Obligation

As a manufacturer subject to the EU Cyber Resilience Act, DEIF is required to notify the CSIRT designated as coordinator and the European Union Agency for Cybersecurity (ENISA) within 24 hours of becoming aware of any actively exploited vulnerability in a product we have placed on the market, and to provide a further notification within 72 hours for any incident with significant impact on product security.

These notifications are made directly to the CSIRT and ENISA through the CRA single reporting platform and are separate from our coordinated disclosure process with vulnerability reporters. Receiving a vulnerability report does not in itself trigger the CSIRT and ENISA notification obligation; the obligation is triggered by evidence of active exploitation in the wild.

7. Policy Review

This policy is reviewed annually and updated to reflect changes in our products, our internal processes, or applicable regulation. The current version is always available at https://www.deif.com/deif-cybersecurity/vulnerability-disclosure-policy/.

8. Contact

For questions about this policy: security@deif.com

For general product security information: https://www.deif.com/deif-cybersecurity/

Read more about cybersecurity in DEIF