Art. 12 Coordinated vulnerability disclosure and a European vulnerability database | NIS 2 directive |

1. Each Member State shall designate one of its CSIRTscomputer security incident response teams as a coordinator for the purposes of coordinated vulnerability means a weakness, susceptibility or flaw of ICT products or ICT services that can be exploited by a cyber threat; disclosure. The CSIRT designated as coordinator shall act as a trusted intermediary, facilitating, where necessary, the interaction between the natural or legal person reporting a vulnerability means a weakness, susceptibility or flaw of ICT products or ICT services that can be exploited by a cyber threat; and the manufacturer or provider of the potentially vulnerable ICT products means an ICT product as defined in Article 2, point (12), of Regulation (EU) 2019/881; or ICT services means digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services;, upon the request of either party. The tasks of the CSIRT designated as coordinator shall include:
  1. identifying and contacting the entities means a natural or legal person created and recognised as such under the national law of its place of establishment, which may, acting under its own name, exercise rights and be subject to obligations; concerned;
  2. assisting the natural or legal persons reporting a vulnerability means a weakness, susceptibility or flaw of ICT products or ICT services that can be exploited by a cyber threat;; and
  3. negotiating disclosure timelines and managing vulnerabilities means a weakness, susceptibility or flaw of ICT products or ICT services that can be exploited by a cyber threat; that affect multiple entities means a natural or legal person created and recognised as such under the national law of its place of establishment, which may, acting under its own name, exercise rights and be subject to obligations;.
2. Member States shall ensure that natural or legal persons are able to report, anonymously where they so request, a vulnerability means a weakness, susceptibility or flaw of ICT products or ICT services that can be exploited by a cyber threat; to the CSIRT designated as coordinator. The CSIRT designated as coordinator shall ensure that diligent follow-up action is carried out with regard to the reported vulnerability means a weakness, susceptibility or flaw of ICT products or ICT services that can be exploited by a cyber threat; and shall ensure the anonymity of the natural or legal person reporting the vulnerability means a weakness, susceptibility or flaw of ICT products or ICT services that can be exploited by a cyber threat;. Where a reported vulnerability means a weakness, susceptibility or flaw of ICT products or ICT services that can be exploited by a cyber threat; could have a significant impact on entities means a natural or legal person created and recognised as such under the national law of its place of establishment, which may, acting under its own name, exercise rights and be subject to obligations; in more than one Member State, the CSIRT designated as coordinator of each Member State concerned shall, where appropriate, cooperate with other CSIRTscomputer security incident response teams designated as coordinators within the CSIRTscomputer security incident response teams network.
1. ENISA shall develop and maintain, after consulting the Cooperation Group means a group as defined in Article 2, point (11), of Directive 2013/34/EU;, a European vulnerability means a weakness, susceptibility or flaw of ICT products or ICT services that can be exploited by a cyber threat; database. To that end, ENISA shall establish and maintain the appropriate information systems, policies and procedures, and shall adopt the necessary technical and organisational measures to ensure the security and integrity of the European vulnerability means a weakness, susceptibility or flaw of ICT products or ICT services that can be exploited by a cyber threat; database, with a view in particular to enabling entities means a natural or legal person created and recognised as such under the national law of its place of establishment, which may, acting under its own name, exercise rights and be subject to obligations;, regardless of whether they fall within the scope of this Directive, and their suppliers of network and information systems means: any device or group of interconnected or related devices, one or more of which, pursuant to a programme, carry out automatic processing of digital data; or digital data stored, processed, retrieved or transmitted by elements covered under points (a) and (b) for the purposes of their operation, use, protection and maintenance; an electronic communications network as defined in Article 2, point (1), of Directive (EU) 2018/1972;, to disclose and register, on a voluntary basis, publicly known vulnerabilities means a weakness, susceptibility or flaw of ICT products or ICT services that can be exploited by a cyber threat; in ICT products means an ICT product as defined in Article 2, point (12), of Regulation (EU) 2019/881; or ICT services means digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services;. All stakeholders shall be provided access to the information about the vulnerabilities means a weakness, susceptibility or flaw of ICT products or ICT services that can be exploited by a cyber threat; contained in the European vulnerability means a weakness, susceptibility or flaw of ICT products or ICT services that can be exploited by a cyber threat; database. That database shall include:
  1. information describing the vulnerability means a weakness, susceptibility or flaw of ICT products or ICT services that can be exploited by a cyber threat;;
  2. the affected ICT products means an ICT product as defined in Article 2, point (12), of Regulation (EU) 2019/881; or ICT services means digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; and the severity of the vulnerability means a weakness, susceptibility or flaw of ICT products or ICT services that can be exploited by a cyber threat; in terms of the circumstances under which it may be exploited;
  3. the availability of related patches and, in the absence of available patches, guidance provided by the competent authoritiesas defined in Article 46 or the CSIRTscomputer security incident response teams addressed to users of vulnerable ICT products means an ICT product as defined in Article 2, point (12), of Regulation (EU) 2019/881; and ICT services means digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; as to how the risks means the potential for loss or disruption caused by an incident and is to be expressed as a combination of the magnitude of such loss or disruption and the likelihood of occurrence of the incident; resulting from disclosed vulnerabilities means a weakness, susceptibility or flaw of ICT products or ICT services that can be exploited by a cyber threat; can be mitigated.