Coordinated Vulnerability Disclosure Policy
1. Purpose and Principle
The security of our elevator components, in particular our operating and display elements and control panels, is our highest priority.
This policy describes our structured process for reporting and handling vulnerabilities. Its purpose is to enable vulnerabilities to be reported to us in a manner that allows us to investigate, assess and remediate them before detailed information is disclosed to third parties or to the public.
2. Scope
This policy applies to all products with digital elements that we place or make available on the market, including their hardware and software components.
It also covers reports of potential vulnerabilities in third-party components where such components form part of our products with digital elements.
3. Reporting Channels and Single Point of Contact
We have designated a single point of contact that is easily identifiable by users and security researchers in order to enable direct and rapid communication and facilitate the reporting of vulnerabilities in our products with digital elements.
Contact for vulnerability reports:
Vulnerabilities can be reported by email to:
Anonymous and indirect reporting:
Vulnerabilities may be reported either directly to us or indirectly and, where requested, anonymously, through national CSIRTs (Computer Security Incident Response Teams) designated as coordinators for the purposes of coordinated vulnerability disclosure pursuant to Article 12(1) of Directive (EU) 2022/2555.
4. Vulnerability Handling Process and Confidentiality
Analysis, assessment and remediation:
Upon receipt of a vulnerability report, we analyse and assess the reported vulnerability. In relation to the risks posed to the affected product with digital elements, we address and remediate vulnerabilities without delay.
Confidentiality and coordinated disclosure:
In order to protect our users, in particular elevator operators and passengers, we ask security researchers and other reporting persons or organisations not to publicly disclose detailed information about a reported vulnerability before we have had the opportunity to investigate, assess and remediate the vulnerability and, where appropriate, make suitable corrective measures available.
Our objective is coordinated disclosure that enables both effective remediation and appropriate information to affected users.
Security updates:
Where necessary to remediate or mitigate a vulnerability, we develop and distribute appropriate patches or security updates during the applicable support period for the respective product.
Security updates are made available without delay and, unless otherwise agreed between us and a business user in relation to a tailor-made product with digital elements, free of charge. They are accompanied by advisory messages and relevant information, including, where applicable, actions to be taken by the user.
Where technically feasible, new security updates are provided separately from functionality updates. Appropriate mechanisms are used to enable the secure distribution of updates.
Information and public disclosure:
Once a security update has been made available, we share and publicly disclose appropriate information about the fixed vulnerability. This may include in particular:
- a description of the vulnerability,
- information allowing users to identify the affected product with digital elements,
- the impact of the vulnerability,
- its severity, and
- clear and accessible information helping users to remediate or mitigate the vulnerability.
In duly justified cases where the security risks associated with publication outweigh the security benefits, we may delay public disclosure of information regarding a fixed vulnerability until users have been given an appropriate opportunity to apply the relevant patch or security update.
5. Availability of this Policy
This Coordinated Vulnerability Disclosure Policy is permanently available through our single point of contact or through our publicly available cybersecurity information.
A reference to the single point of contact and to this policy is also provided in the information and instructions accompanying our products with digital elements.