Cyber Resilience Act – CECE co-signs a joint statement on vulnerability reporting

CECE, together with a diverse coalition of industries and NGOs, issues a joint letter on the vulnerability reporting obligations imposed on manufacturers under the Cyber Resilience Act.

The initiative aims to warn co-legislators on the cybersecurity risks associated with mandating the reporting of ‘unpatched vulnerabilities’: the premature reporting will have an impact on product safety with increased exposure to further cyberattacks, while the collection of such sensitive data will only attract more malicious actors from around the world. 

The coalition of co-signatories calls on the European Parliament and Council to remove these obligations. Vulnerability reporting should indeed be limited only to patched vulnerabilities that have been actively exploited and pose a significant cybersecurity risk.