image/svg+xml ITA flag Italian Flag 2013-10-04T11:07:53 As it didn't exist on Open Clipart, here is the italian Flag, enjoy https://openclipart.org/detail/184542/italian-flag-by-lolobosse-184542 lolobosse country europa europe flag green italian italie italy land red white

Coordinated Vulnerability Disclosure (CVD) Policy

Esisoftware S.r.l. — Pursuant to EU Regulation (EU) 2024/2847 (Cyber Resilience Act – CRA)

  1. Introduction and Purpose

As a provider of industrial software solutions and enterprise integration systems, Esisoftware S.r.l. regards the security of its solutions, products and infrastructure as a key priority. In accordance with the provisions of the Cyber Resilience Act (CRA) and the recommendations of the European Union Agency for Cybersecurity (ENISA), we have adopted a Coordinated Vulnerability Disclosure (CVD) policy for the management, analysis and timely resolution of potential security vulnerabilities reported by researchers, customers, partners and end users.

  1. Scope

This policy applies to all software products, APIs, cloud services, web platforms and components developed or managed directly by Esisoftware S.r.l.

In Scope (Included)

  • Proprietary software applications, on-premises components and integration systems provided to customers.
  • API interfaces, backend services, microservices and communication modules included in Esisoftware solutions.
  • Libraries, middleware and integration agents developed by Esisoftware S.r.l.

Out of Scope (Excluded)

  • Services and infrastructure managed by third parties not under the direct control of Esisoftware.
  • Denial of Service (DoS / DDoS) attacks or resource saturation.
  • Social engineering

 

  1. How to Submit a Report

If you have identified a potential vulnerability or security breach, please report it to us promptly by
following the instructions below.

Contact Channel – Details and References

Security Email
security@esisoftware.it

PGP Public Key
https://www.esisoftware.it/pgp-key.asc

PGP Fingerprint
37BE BCB1 19A6 0A22 5E1D C839 7FAC 8707 FB1D CFFE

RFC 9116 File
https://www.esisoftware.it/.well-known/security.txt

Guidelines for submitting a report

  • Data encryption: We strongly recommend encrypting your email using our PGP public key, particularly when the report contains directly exploitable technical details (Proof of Concept).
  • Required information: Please include a detailed description of the issue, the potential impact, the affected software version or URL, and detailed steps to reproduce the vulnerability (Proof of Concept).
  • Confidentiality: Do not disclose the vulnerability publicly or to third parties before Esisoftware has analyzed it and released an appropriate fix or mitigation.

 

  1. Vulnerability Management Process

Esisoftware S.r.l. is committed to handling every report in accordance with the stages defined by the ISO/IEC 29147 and ISO/IEC 30111 standards:

  1. Acknowledgement: Within 48 working hours of the report being submitted, we will send an acknowledgement of receipt to the reporter.
  2. Assessment and Triage: The security team will analyze the report, verify that the issue can be reproduced, and assess its severity based on the CVSS (Common Vulnerability Scoring System) score.
  3. Resolution and Patching: A fix or mitigation measure proportionate to the identified risk level will be developed.
  4. Coordinated Disclosure and Notification: Once the patch or update is available, we will agree with the reporter on the procedures and timing for any coordinated publication.
    Where required by CRA regulations or by the relevant authorities (e.g. CSIRT Italia / ENISA), we will send official notifications within the timeframes stipulated by law.

 

  1. Safe Harbour and Good Faith Principles

Esisoftware S.r.l. values the contribution of the cyber security community and independent researchers.
We guarantee that we will not take legal action against anyone conducting security research or reporting issues in good faith, provided that:

  • Applicable laws and the privacy of users and customers are respected.
  • Confidential data or data belonging to third parties is not destroyed, altered or  extracted.
  • No tests are carried out that compromise the availability and stability of services (e.g. DoS/DDoS).
  • Esisoftware is granted a reasonable period of time to rectify the issue before any public disclosure.

 

6. Recognition

Subject to the reporter’s consent, Esisoftware will be pleased to publicly acknowledge the contribution of researchers who help improve the security of our products and our users.

 

Last update of the Policy: September 2026