Cybersecurity

Coordinated vulnerability disclosure policy

Itemedical takes cybersecurity seriously and welcomes good-faith reports of potential cybersecurity vulnerabilities. This policy describes how vulnerabilities related to itemedical products can be reported, how they are handled, and how remediation and disclosure are coordinated.

Vulnerability reporting

Please report potential vulnerabilities to the address mentioned below, including:

The name of the related product
The version number
A vulnerability description
Reproduction step.
Proof-of-concept vulnerability exploit details
Exploit information
Contact information
The impact on confidentiality, integrity, and/or availability

Avoid sharing unnecessary sensitive or personal information.

Vulnerability handling

A vulnerability report is acknowledged as soon as possible after receipt
The applicability of the report is assessed
A reproduction is performed if possible
The vulnerability is assessed for its severity and exploitability, affected product(s), component(s), and versions, as well as the potential impact

Coordinated vulnerability disclosure

Coordination is performed with the reporter, any affected supplier(s), customers, and the appropriate regulatory reporting channels with appliable statutory deadlines. In the case of a non-medical product, a CSIRT is involved where necessary. Other relevant parties are informed where appropriate. Applicable vigilance procedures are followed.
Mitigations or security updates are provided without undue delay proportionate to the risk.
Once a mitigation or update is available, information is disclosed about fixed vulnerabilities, unless delayed disclosure is justified by the cybersecurity risk. An appropriate level of transparency should keep customers protected.