CVD Policy Template for OEM Manufacturers

[COMPANY NAME] is an Original Equipment Manufacturer (OEM) supplying [components / modules / chipsets / firmware / software - select applicable] that are integrated into products placed on the EU market by our customers (downstream manufacturers). We recognise that our products form part of the supply chain of connected products subject to the EU Cyber Resilience Act (Regulation (EU) 2024/2847).

This Coordinated Vulnerability Disclosure (CVD) policy governs how [COMPANY NAME] receives, assesses, and responds to security vulnerability reports affecting our components and subsystems, and how we coordinate with both upstream component suppliers and downstream product integrators.

This policy covers vulnerabilities in the following [COMPANY NAME] components and subsystems:

• [MODULE / CHIPSET NAME 1] (part number [PN], firmware/SDK version [X.X] and later)
• [MODULE / CHIPSET NAME 2] (part number [PN], version [X.X] and later)
• [FIRMWARE / SDK NAME] (version [X.X] and later)
• Reference designs and evaluation kits incorporating the above

Out of scope:

• Vulnerabilities introduced by downstream product integrators during their own integration or customisation
• Vulnerabilities in customer-developed application code running on our platforms
• Components at end-of-supply (see lifecycle schedule at [EOL URL])

Downstream product scope: Our policy does not cover the end products into which our components are integrated. Those products are the responsibility of the downstream manufacturer. However, we will coordinate with downstream manufacturers when a component vulnerability affects their products.

Security vulnerabilities in [COMPANY NAME] components may be reported by:

• Security researchers
• Downstream product manufacturers (our customers)
• End users who have identified a component-level issue
• Upstream component suppliers with a supply chain finding

Report via: Portal: [VULNERABILITY DISCLOSURE PORTAL URL] Email: [[email protected]] PGP key: Fingerprint [FINGERPRINT], available at [PGP KEY URL]

Downstream manufacturer escalation (existing customers): Customers under active supply agreements may report via our customer security portal at [CUSTOMER PORTAL URL] for priority handling.

Please include:

• Component part number, hardware revision, and firmware/SDK version
• Description of the vulnerability and exploitation conditions
• Whether the vulnerability is present in publicly released versions or unreleased builds
• If reporting as a downstream manufacturer: affected product lines and estimated deployment volume

When [COMPANY NAME] confirms a vulnerability in a component that is or may be integrated into downstream products, we commit to:

1. Notify affected downstream manufacturers before or simultaneous with public advisory publication.
2. Provide downstream manufacturers with:
   • Technical vulnerability details sufficient to assess impact in their product context
   • CVSS base score and CWE classification
   • A fixed component version, patch, or workaround
   • An estimated timeline for fixed component availability
   • Template language for their own customer advisory, where helpful
3. Allow downstream manufacturers a reasonable period to prepare and release their own patches before joint public advisory publication.

Coordination window: We request [30–60] days from the time we notify downstream manufacturers to allow them to integrate and release fixed component versions before the joint advisory is published.

Emergency exception: Where a vulnerability is actively exploited, we will notify downstream manufacturers and publish advisory immediately.

Where a vulnerability reported to [COMPANY NAME] originates in an upstream component (a chipset, IP block, library, or subsystem supplied to us by a third party), [COMPANY NAME] will:

1. Notify the upstream supplier within [5] business days of confirming the component-level root cause.
2. Coordinate disclosure timing with the upstream supplier.
3. Monitor upstream remediation progress and include status in our downstream customer notifications.
4. Publish our own advisory documenting the upstream CVE and our component's fix status - even if upstream remediation is still in progress.

Where an upstream supplier does not respond within [30] days or refuses to remediate a confirmed vulnerability, [COMPANY NAME] reserves the right to publish an advisory with available mitigations, in coordination with the researcher and downstream customers.

[COMPANY NAME] commits to the following response timeline:

| Milestone | Target | |---|---| | Acknowledgment to reporter | Within 48 hours | | Initial triage and severity assessment | Within 5 business days | | Downstream manufacturer notification | Within 10 business days of confirmation | | Fixed component / patch availability | Per severity SLA below | | Public advisory | After downstream notification period + researcher embargo |

Severity SLAs (time to fixed component release): | Severity | CVSS Range | SLA | |---|---|---| | Critical | 9.0–10.0 | 14 days | | High | 7.0–8.9 | 45 days | | Medium | 4.0–6.9 | 90 days | | Low | 0.1–3.9 | Next release |

SLAs measure time to fixed component availability, not end-product patch release (which is the downstream manufacturer's SLA).

[COMPANY NAME] authorises security research conducted in good faith on our components in accordance with this policy. We will not pursue legal action against researchers who:

• Acquire [COMPANY NAME] components or evaluation kits through legitimate channels for research purposes
• Limit testing to their own components or devices for which they have explicit permission
• Do not use vulnerability findings to compromise third-party systems
• Report to us before disclosing to any downstream manufacturer or the public
• Comply with applicable law

Researchers who discover vulnerabilities in end products incorporating [COMPANY NAME] components are encouraged to report to both the end product manufacturer and [COMPANY NAME] simultaneously.