CVD Policy Template for Contract Manufacturers

[COMPANY NAME] is a contract manufacturer that produces electronic products and connected devices on behalf of brand owner customers (our 'principals'). We may operate as an Electronics Manufacturing Services (EMS) provider, an Original Design Manufacturer (ODM), or both.

This Coordinated Vulnerability Disclosure (CVD) policy governs how [COMPANY NAME] handles security vulnerability reports that relate to:

1. Products we design and manufacture under our own reference designs (ODM products)
2. Manufacturing process vulnerabilities that could affect the integrity of products we build for brand owners
3. Component or supply chain vulnerabilities identified during our quality and security processes

For products manufactured to a brand owner's design specification, security vulnerability handling is primarily the brand owner's responsibility. [COMPANY NAME] will coordinate with brand owners as required under our contractual obligations and the CRA Article 13(4) supply chain requirements.

ODM Products (our designs) The following products are [COMPANY NAME] original designs, sold to brand owners who may rebrand and place them on the EU market. [COMPANY NAME] bears primary responsibility for vulnerability disclosure for these designs:

• Reference design [NAME/SKU] (hardware revision [X], firmware [X.X] and later)
• Reference design [NAME/SKU] (hardware revision [X], firmware [X.X] and later)

EMS Manufacturing (brand owner designs) For products we manufacture to a brand owner's specification, the brand owner bears primary CVD responsibility. [COMPANY NAME]'s obligations are limited to:

• Reporting manufacturing process vulnerabilities that could compromise product integrity
• Coordinating on component-level supply chain vulnerabilities identified during production
• Providing manufacturing-related information to brand owners upon request for their CVD processes

Manufacturing process scope:

• Firmware flashing and provisioning processes
• Cryptographic key injection and certificate management during manufacturing
• Supply chain and component authenticity verification

For vulnerabilities in [COMPANY NAME] ODM designs: Portal: [VULNERABILITY DISCLOSURE PORTAL URL] Email: [[email protected]] PGP key: Fingerprint [FINGERPRINT], available at [PGP KEY URL]

Please include:

• Reference design name/SKU and hardware/firmware version
• Brand owner product name (if known - helps identify affected deployments)
• Description of the vulnerability, exploitation conditions, and potential impact
• Proof of concept and reproduction steps

For vulnerabilities that may be manufacturing process related (e.g. compromised firmware during production, key injection issues): Email: [[email protected]]

Brand owner customers: For issues relating to products under your brand, please contact us via our customer security portal at [CUSTOMER PORTAL URL] or your account manager with subject line 'SECURITY ESCALATION'.

For vulnerabilities in [COMPANY NAME] ODM reference designs:

| Milestone | Target | |---|---| | Acknowledgment | Within 48 hours | | Initial triage and severity assessment | Within 5 business days | | Brand owner notification | Within 10 business days of confirmation | | Fixed design / firmware availability | Per severity SLA below | | Public advisory | After brand owner notification period |

Brand owner notification: When a vulnerability is confirmed in an ODM design, [COMPANY NAME] will notify all brand owners with active licences to that reference design. We will provide:

• Technical vulnerability details and CVSS score
• Fixed firmware or design update
• Template advisory language
• A [30]-day coordination window before public advisory publication

Severity SLAs (time to fixed firmware/design): | Severity | CVSS Range | SLA | |---|---|---| | Critical | 9.0–10.0 | 14 days | | High | 7.0–8.9 | 45 days | | Medium | 4.0–6.9 | 90 days | | Low | 0.1–3.9 | Next design cycle |

[COMPANY NAME] implements the following controls to prevent manufacturing process vulnerabilities from affecting product security:

Firmware integrity: All firmware is cryptographically signed before flashing. Build hashes are recorded and verifiable.

Key injection security: Cryptographic keys and certificates injected during manufacturing are managed under [HSM / SECURE KEY MANAGEMENT PROCESS]. Access is restricted to [NAMED PERSONNEL / PROCESS].

Supply chain authenticity: Components are sourced through authorised distributors. Incoming components for security-critical functions are subject to [AUTHENTICITY VERIFICATION PROCESS].

Audit trail: All firmware flashing, key injection, and provisioning operations are logged and auditable.

If you believe a product may have been compromised during the manufacturing process (e.g. counterfeit components, tampered firmware), please contact us immediately at [[email protected]] or by phone at [PHONE NUMBER].

[COMPANY NAME] recognises that brand owners who sell products incorporating our ODM designs bear the primary CRA compliance obligation. We commit to supporting brand owners in meeting their obligations:

• Timely notification: We will notify brand owners of confirmed vulnerabilities within 10 business days, before any public advisory.
• Technical information: We will provide all technical details necessary for brand owners to assess impact and prepare their own customer advisories.
• Article 14 support: We will notify brand owners immediately if a vulnerability in our ODM design is actively exploited, so they can meet their own ENISA reporting obligations.
• SBOM information: We will provide up-to-date Software Bill of Materials (SBOM) information for our designs to support brand owners' CRA documentation obligations.
• Audit support: We will respond to reasonable requests for documentation of our CVD processes from brand owners conducting supply chain due diligence.

Brand owners should ensure their supply agreements with [COMPANY NAME] include provisions for security notification and coordination.

[COMPANY NAME] authorises security research conducted in good faith on our ODM products in accordance with this policy. We will not pursue legal action against researchers who:

• Acquire [COMPANY NAME]-designed products (under any brand) through legitimate channels for research
• Limit testing to devices they own or have explicit permission to test
• Do not access third-party systems or other users' devices
• Report to [COMPANY NAME] before disclosing to any brand owner, the public, or any third party
• Comply with applicable law

Note: If a product is sold under a brand owner's name, we encourage researchers to also notify the brand owner simultaneously. [COMPANY NAME] will coordinate with the brand owner on your behalf if you prefer.