Skip to content
RGPD

Article 12

Coordinated vulnerability disclosure and a European vulnerability database

1.   Each Member State shall designate one of its CSIRTs as a coordinator for the purposes of coordinated vulnerability disclosure. The CSIRT designated as coordinator shall act as a trusted intermediary, facilitating, where necessary, the interaction between the natural or legal person reporting a vulnerability and the manufacturer or provider of the potentially vulnerable ICT products or ICT services, upon the request of either party. The tasks of the CSIRT designated as coordinator shall include:

(a)

identifying and contacting the entities concerned;

(b)

assisting the natural or legal persons reporting a vulnerability; and

(c)

negotiating disclosure timelines and managing vulnerabilities that affect multiple entities.

Member States shall ensure that natural or legal persons are able to report, anonymously where they so request, a vulnerability to the CSIRT designated as coordinator. The CSIRT designated as coordinator shall ensure that diligent follow-up action is carried out with regard to the reported vulnerability and shall ensure the anonymity of the natural or legal person reporting the vulnerability. Where a reported vulnerability could have a significant impact on entities in more than one Member State, the CSIRT designated as coordinator of each Member State concerned shall, where appropriate, cooperate with other CSIRTs designated as coordinators within the CSIRTs network.

2.   ENISA shall develop and maintain, after consulting the Cooperation Group, a European vulnerability database. To that end, ENISA shall establish and maintain the appropriate information systems, policies and procedures, and shall adopt the necessary technical and organisational measures to ensure the security and integrity of the European vulnerability database, with a view in particular to enabling entities, regardless of whether they fall within the scope of this Directive, and their suppliers of network and information systems, to disclose and register, on a voluntary basis, publicly known vulnerabilities in ICT products or ICT services. All stakeholders shall be provided access to the information about the vulnerabilities contained in the European vulnerability database. That database shall include:

(a)

information describing the vulnerability;

(b)

the affected ICT products or ICT services and the severity of the vulnerability in terms of the circumstances under which it may be exploited;

(c)

the availability of related patches and, in the absence of available patches, guidance provided by the competent authorities or the CSIRTs addressed to users of vulnerable ICT products and ICT services as to how the risks resulting from disclosed vulnerabilities can be mitigated.
Common Questions

Frequently Asked Questions

What is a coordinated vulnerability disclosure and why is it important?

Coordinated vulnerability disclosure helps security teams and product vendors communicate effectively about security weaknesses, allowing vendors to develop fixes before flaws become widely known and exploited;

it ensures vulnerabilities are handled carefully, reducing risks and protecting both users and providers through clear, coordinated communication between parties.

Who can report vulnerabilities, and can reports be anonymous?

Anyone, whether an individual or a company, can report potential vulnerabilities to the designated national cybersecurity team (CSIRT);

these reports can be made anonymously if preferred, encouraging people to share important security details without worrying about their privacy or any unwanted consequences.

What is the role of ENISA regarding the European vulnerability database?

ENISA is responsible for creating and maintaining a European vulnerability database that records public vulnerabilities in ICT products and services, ensuring everyone has access to critical security information and guidance;

its role includes ensuring data security, database integrity, and providing clear guidelines to help various entities manage potential cybersecurity threats effectively.

What kind of information does the European vulnerability database provide?
The European vulnerability database gives clear and helpful data on cybersecurity weaknesses, identifying which ICT products or services might be vulnerable, explaining how serious the vulnerabilities are, suggesting available solutions or patches, and providing expert advice when no patch is available, helping organizations to protect themselves against potential cyber threats.
← Article 11 Article 13 →