Skip to the text
Text as of 16 Jan 2023 · Consolidated version of 27 December 2022 · Same wording as today’s text.Today’s text

Article 12 — Coordinated vulnerability disclosure and a European vulnerability database

Digital & dataLevel 1DirectiveNIS2In forceOfficial source

12(1)

1.Each Member State shall designate one of its CSIRTs as a coordinator for the purposes of coordinated vulnerability disclosure. The CSIRT designated as coordinator shall act as a trusted intermediary, facilitating, where necessary, the interaction between the natural or legal person reporting a vulnerability and the manufacturer or provider of the potentially vulnerable ICT products or ICT services, upon the request of either party. The tasks of the CSIRT designated as coordinator shall include:

Copy link
12(1)(a)
(a)identifying and contacting the entities concerned;
Copy link
12(1)(b)
(b)assisting the natural or legal persons reporting a vulnerability; and
Copy link
12(1)(c)
(c)negotiating disclosure timelines and managing vulnerabilities that affect multiple entities.
Copy link

Member States shall ensure that natural or legal persons are able to report, anonymously where they so request, a vulnerability to the CSIRT designated as coordinator. The CSIRT designated as coordinator shall ensure that diligent follow-up action is carried out with regard to the reported vulnerability and shall ensure the anonymity of the natural or legal person reporting the vulnerability. Where a reported vulnerability could have a significant impact on entities in more than one Member State, the CSIRT designated as coordinator of each Member State concerned shall, where appropriate, cooperate with other CSIRTs designated as coordinators within the CSIRTs network.

12(2)

2.ENISA shall develop and maintain, after consulting the Cooperation Group, a European vulnerability database. To that end, ENISA shall establish and maintain the appropriate information systems, policies and procedures, and shall adopt the necessary technical and organisational measures to ensure the security and integrity of the European vulnerability database, with a view in particular to enabling entities, regardless of whether they fall within the scope of this Directive, and their suppliers of network and information systems, to disclose and register, on a voluntary basis, publicly known vulnerabilities in ICT products or ICT services. All stakeholders shall be provided access to the information about the vulnerabilities contained in the European vulnerability database. That database shall include:

Copy link
12(2)(a)
(a)information describing the vulnerability;
Copy link
12(2)(b)
(b)the affected ICT products or ICT services and the severity of the vulnerability in terms of the circumstances under which it may be exploited;
Copy link
12(2)(c)
(c)the availability of related patches and, in the absence of available patches, guidance provided by the competent authorities or the CSIRTs addressed to users of vulnerable ICT products and ICT services as to how the risks resulting from disclosed vulnerabilities can be mitigated.
Copy link