Paragraph 2 Information on how to report security issues

(1)

A manufacturer is to be treated as complying with the security requirement at paragraph 2 of Schedule 1 where the condition in sub-paragraph (2) is met.

(2)

The condition is that the manufacturer complies with—

(a)

provision 5.2-1 of ETSI EN 303 645; or

(b)

subject to sub-paragraphs (3) and (4), the following paragraphs of ISO/IEC 29147—

(i)

paragraph 6.2.2;

(ii)

paragraph 6.2.5; and

(iii)

paragraph 6.5

as if the provision of ETSI EN 303 645 or the paragraphs of ISO/IEC29147 apply to the categories of hardware and software specified in paragraph 2(1) of Schedule 1.

(3)

A manufacturer is required to publish information as to—

(a)

how a person may access the mechanism for the manufacturer to receive reports described in paragraph 6.2.2 of ISO/IEC 29147;

(b)

when a person making a vulnerability report will receive an acknowledgement of receipt of a report described in paragraph 6.2.5 of ISO/IEC 29147; and

(c)

when a person making a vulnerability report will receive ongoing communication as described in paragraph 6.5 of ISO/IEC 29147

(4)

The information at sub-paragraph (3) must be accessible, clear and transparent, and must be made available to a person (“P”)—

(a)

without prior request for such information being made;

(b)

in English;

(c)

free of charge; and

(d)

without requesting the provision of P’s personal information.