Annex I Essential cybersecurity requirements

identify and document vulnerabilities means a weakness, susceptibility or flaw of a product with digital elements that can be exploited by a cyber threat; and components means software or hardware intended for integration into an electronic information system; contained in products with digital elements means a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately;, including by drawing up a software bill of materials means a formal record containing details and supply chain relationships of components included in the software elements of a product with digital elements; in a commonly used and machine-readable format covering at the very least the top-level dependencies of the products;

in relation to the risks means the potential for loss or disruption caused by an incident and is to be expressed as a combination of the magnitude of such loss or disruption and the likelihood of occurrence of the incident; posed to products with digital elements means a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately;, address and remediate vulnerabilities means a weakness, susceptibility or flaw of a product with digital elements that can be exploited by a cyber threat; without delay, including by providing security updates; where technically feasible, new security updates shall be provided separately from functionality updates;

apply effective and regular tests and reviews of the security of the product with digital elements means a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately;;

once a security update has been made available, share and publicly disclose information about fixed vulnerabilities means a weakness, susceptibility or flaw of a product with digital elements that can be exploited by a cyber threat;, including a description of the vulnerabilities means a weakness, susceptibility or flaw of a product with digital elements that can be exploited by a cyber threat;, information allowing users to identify the product with digital elements means a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately; affected, the impacts of the vulnerabilities means a weakness, susceptibility or flaw of a product with digital elements that can be exploited by a cyber threat;, their severity and clear and accessible information helping users to remediate the vulnerabilities means a weakness, susceptibility or flaw of a product with digital elements that can be exploited by a cyber threat;; in duly justified cases, where manufacturers means a natural or legal person who develops or manufactures products with digital elements or has products with digital elements designed, developed or manufactured, and markets them under its name or trademark, whether for payment, monetisation or free of charge; consider the security risks means the potential for loss or disruption caused by an incident and is to be expressed as a combination of the magnitude of such loss or disruption and the likelihood of occurrence of the incident; of publication to outweigh the security benefits, they may delay making public information regarding a fixed vulnerability means a weakness, susceptibility or flaw of a product with digital elements that can be exploited by a cyber threat; until after users have been given the possibility to apply the relevant patch;

put in place and enforce a policy on coordinated vulnerability means a weakness, susceptibility or flaw of a product with digital elements that can be exploited by a cyber threat; disclosure;

take measures to facilitate the sharing of information about potential vulnerabilities means a weakness, susceptibility or flaw of a product with digital elements that can be exploited by a cyber threat; in their product with digital elements means a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately; as well as in third-party components means software or hardware intended for integration into an electronic information system; contained in that product, including by providing a contact address for the reporting of the vulnerabilities means a weakness, susceptibility or flaw of a product with digital elements that can be exploited by a cyber threat; discovered in the product with digital elements means a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately;;

provide for mechanisms to securely distribute updates for products with digital elements means a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately; to ensure that vulnerabilities means a weakness, susceptibility or flaw of a product with digital elements that can be exploited by a cyber threat; are fixed or mitigated in a timely manner and, where applicable for security updates, in an automatic manner;

ensure that, where security updates are available to address identified security issues, they are disseminated without delay and, unless otherwise agreed between a manufacturer means a natural or legal person who develops or manufactures products with digital elements or has products with digital elements designed, developed or manufactured, and markets them under its name or trademark, whether for payment, monetisation or free of charge; and a business user in relation to a tailor-made product with digital elements means a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately;, free of charge, accompanied by advisory messages providing users with the relevant information, including on potential action to be taken.