Disclosure Policy
1. Purpose and Scope
This policy establishes a structured, transparent process for receiving, acknowledging, triaging, remediating and disclosing security vulnerabilities reported in products with digital elements placed on the market by Additive Industries (“the Manufacturer”).
It applies to all internally developed and third-party components, including open-source software, integrated into products with digital elements covered by this policy.
This policy implements Article 13(6) and Article 14 of the Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, and the essential cybersecurity requirements for vulnerability handling set out in Annex I, Part II.
The policy covers vulnerabilities in hardware, firmware and software components of all products with digital elements placed by Additive Industries on the EU market, including third-party dependencies listed in the applicable product SBOM.
2. Definitions and Acronyms
| Definition / Acronym | Explanation |
|---|---|
| CRA | Cyber Resilience Act, Regulation (EU) 2024/2847. |
| CSIRT | Computer Security Incident Response Team. |
| CVE | Common Vulnerabilities and Exposures identifier. |
| CVSS | Common Vulnerability Scoring System. |
| ENISA | European Union Agency for Cybersecurity. |
| IACS | Industrial Automation and Control Systems. |
| OT | Operational Technology. |
| PGP | Pretty Good Privacy encryption. |
| PSIRT | Product Security Incident Response Team. |
| SBOM | Software Bill of Materials. |
| TLS | Transport Layer Security. |
| Vulnerability | A weakness, susceptibility or flaw that can be exploited by a cyber threat. |
3. How to Report a Vulnerability
We maintain a publicly accessible and clearly documented single point of contact for vulnerability reports.
3.1 Reporting Channels
- Email: security@additiveindustries.com
- Security.txt: https://additiveindustries.com/.well-known/security.txt
- Reports may also be submitted through a designated national CSIRT coordinator or ENISA’s reporting platform.
3.2 Information to Include in a Report
- Affected product name, version and component.
- Description of the vulnerability and potential impact.
- Steps to reproduce or proof-of-concept.
- Proposed CVSS rating, if available.
- Reporter contact details, unless reported anonymously.
4. Secure Communication and Encryption
- PGP Key: https://additiveindustries.com/.well-known/pgp-key.txt
- Key fingerprint: 8CE10868F4A0652CFBDA256AD2372B98CE3354E4
- All web-based submission channels use HTTPS and TLS 1.3 or later.
- Encryption keys are periodically rotated.
5. Safe Harbour Protection
- We will not initiate or support legal action against researchers acting in good faith.
- Researchers must avoid privacy violations, data destruction or service disruption.
- Any accidentally accessed personal data should be reported immediately and not retained.
6. Vulnerability Handling and Disclosure Process
6.1 Acknowledgement
- Receipt of reports will be acknowledged within 24 hours.
- A unique tracking reference will be assigned.
6.2 Triage and Assessment
- Assessment will be performed using CVSS v3.1 or later.
- Impacted SBOM components will be identified.
- Actively exploited vulnerabilities trigger mandatory notification obligations.
6.3 Remediation
- Security updates and patches will be developed without undue delay.
- Updates are provided free of charge.
- For OT environments, patches are validated in FAT or isolated test environments.
6.4 Coordinated Disclosure
- Initial response will be provided after triage.
- Public disclosure occurs only after remediation or mitigation is available.
- Remediated vulnerabilities are recorded in the vulnerability register.
- SBOM and technical documentation are updated.
- A root-cause analysis is performed.
- CVE identifiers are requested when eligibility criteria are met.
7. Mandatory CSIRT and ENISA Notification
| Deadline | Deliverable |
|---|---|
| Within 24 hours of awareness | Early warning notification |
| Within 72 hours of awareness | Vulnerability or incident notification |
| No later than 14 days after corrective measures are available | Final vulnerability report |
| Within 1 month of incident notification | Final incident report |
Notifications are submitted through the ENISA reporting platform to the coordinating CSIRT for the Netherlands, NCSC.
8. Record Keeping and Traceability
Vulnerability reports, remediation records, notifications and disclosure correspondence are retained as part of CRA technical documentation.
- Minimum retention period of 10 years after market placement.
- Or for the full product support period, whichever is longer.
- Documentation remains available to market surveillance authorities.
9. Policy Review and Governance
- Reviewed at least annually.
- Reviewed after significant organizational changes.