Paragraph 2 Information on how to report security issues

(1)

The following sub-paragraphs apply to—

(a)

hardware of the product;

(b)

software which is pre-installed on the product at the point at which the product is supplied to a customer;

(c)

software which must be installed on the product for all manufacturer’s intended purposes of the product that use—

(i)

hardware;

(ii)

software that is pre-installed at the point at which the product is supplied to a customer; or

(iii)

software that is installable;

(d)

software used for, or in connection with, any manufacturer’s intended purpose of the product unless the product is a smartphone or a tablet computer capable of connecting to cellular networks.

(2)

The following information must be published—

(a)

at least one point of contact to allow a person (“P”) to report to the manufacturer security issues relating to the categories listed in sub-paragraph (1) for any of the manufacturer’s relevant connectable products for which they have an obligation under section 8 (duty to comply with security requirements); and

(b)

when P will receive—

(i)

an acknowledgment of the receipt of a security issues report; and

(ii)

status updates until the resolution of the reported security issues.

(3)

The information in sub-paragraph (2) must be accessible, clear and transparent, and must be made available to P—

(a)

without prior request for such information being made;

(b)

in English;

(c)

free of charge; and

(d)

without requesting the provision of P’s personal information.