Cybersecurity & Vulnerability Disclosure

Cybersecurity of Our Machines

At Smart Automation, we pay attention to the cybersecurity of the machines and control systems we design and supply.

Despite our efforts, vulnerabilities may exist in the software, firmware, hardware components or configuration of our machines.

We believe it is important that potential cybersecurity vulnerabilities can be reported to us responsibly, so that we can investigate them and take appropriate measures where necessary.

We therefore maintain a Coordinated Vulnerability Disclosure (CVD) Policy.

1. Reporting a Vulnerability

Have you discovered a potential cybersecurity vulnerability in a machine supplied by us or one of its components? If so, we kindly ask you to report it to us.

Contact details

• Email: info@smart-automation.nl
• Telephone: +31 (0) 314 76 00 55
• Company: Smart Automation

This reporting channel is intended for customers, suppliers, security researchers and other parties wishing to report a potential cybersecurity vulnerability.

For routine malfunctions, maintenance or service requests, please use our usual service channels.

2. What Types of Vulnerabilities Can You Report?

Our reporting channel is intended for potential cybersecurity vulnerabilities in machines and associated digital systems developed or supplied by us.

Examples include:

• PLC controls and associated software
• HMI systems and operator panels
• Industrial computers and control software
• Network components and communication links
• Remote access and service connections
• Firmware and software of integrated components, such as servo drives and variable frequency drives
• Software developed by us and machine configurations

Vulnerabilities in third-party components used in our machines can also be reported to us.

3. What Information Would We Like to Receive?

To enable us to investigate a report effectively, we ask you to provide as much of the following information as possible:

• A clear description of the potential vulnerability
• The type of machine and, if known, the machine serial number
• The component or system involved
• Relevant software or firmware versions, if known
• The circumstances under which the vulnerability occurs
• A description of the potential consequences
• Any technical information that would help us reproduce the vulnerability

Where possible, please also include your contact details so that we can request additional information if necessary.

Do not send passwords, access codes, personal data or other confidential information via unencrypted email. If you need to share sensitive information, please contact us first to agree on a secure method of transfer.

4. Responsible Disclosure

We appreciate vulnerabilities being reported in a careful and responsible manner.

We therefore ask reporters to:

• Report any discovered vulnerability to us as soon as reasonably possible.
• Avoid performing any actions beyond those necessary to establish the existence of a vulnerability.
• Not delete, modify or unnecessarily collect data.
• Avoid activities that could compromise the availability, operation or safety of machines.
• Not use malware, denial-of-service attacks or social engineering techniques.
• Treat information about the vulnerability as confidential and coordinate any public disclosure with us in advance.

Research or testing on machines and systems belonging to our customers may only be carried out with the explicit permission of the relevant owner or administrator. This policy does not grant such permission.

5. How Do We Handle Your Report?

Upon receipt of a report, we follow our internal vulnerability management process.

This process consists of the following steps:

1. Acknowledgement: We register the report and, where contact details are available, acknowledge receipt.
2. Assessment: We investigate whether the vulnerability affects our machines and assess the potential cybersecurity risk.
3. Mitigation: Where necessary, we determine an appropriate solution or temporary risk mitigation measure.
4. Verification: We assess and test any changes for cybersecurity, machine functionality and, where relevant, machine safety.
5. Communication: Where necessary, we inform affected customers and other stakeholders about the vulnerability and possible mitigation measures.
6. Closure: We document our findings and the measures taken.

We aim to send an acknowledgement of receipt within two working days and provide an initial substantive response within five working days.

For urgent reports, we will endeavour to take appropriate measures as quickly as possible.

The time required to implement a permanent solution depends on the nature and complexity of the vulnerability and the availability of any necessary updates from suppliers.

6. Coordinated Disclosure

We aim to handle vulnerabilities in a careful and coordinated manner.

Where public disclosure of a vulnerability is desirable or necessary, we will, where possible, coordinate the content and timing of the disclosure with the reporter, relevant suppliers and other parties involved.

In doing so, we take into account the safety of our customers, the availability of potential solutions and our legal information and reporting obligations.

7. Security Updates and Customer Information

When a cybersecurity vulnerability may affect a machine we have supplied, we assess which machines and customers may be affected.

Where necessary, we provide affected customers with information about available security updates, configuration changes or other measures to mitigate the risk.

As our machines are developed to meet customer-specific requirements, the measures required may vary from one machine to another.

8. Contact

For cybersecurity questions or vulnerability reports, please contact us via:

Smart Automation

Email: info@smart-automation.nl

Telephone: +31 (0) 314 76 00 55

Website: www.smart-automation.nl

This policy applies to reports of potential cybersecurity vulnerabilities in our products. It is separate from our standard service, maintenance and warranty arrangements.