Article 12 vulnerability disclosure Coordinated vulnerability mechanisms Cybersecurity vulnerability coordination NIS 2 Directive disclosure

NIS 2 Directive Article 12 – Coordinated Vulnerability Disclosure and a European Vulnerability Database

Mar 7, 2025by Kira Hk

Introduction

The NIS 2 Directive, or the Directive on Security of Network and Information Systems, is a crucial piece of legislation in the European Union that aims to bolster cybersecurity measures and ensure the resilience of critical infrastructure. One of the key aspects of the NIS 2 Directive is Article 12, which focuses on coordinated vulnerability disclosure and establishing a European vulnerability database.

NIS 2 Directive Article 12 – Coordinated Vulnerability Disclosure and a European Vulnerability Database

Let's delve into the details of Article 12 and its implications.

Coordinated Vulnerability Disclosure

Under Article 12 of the NIS 2 Directive, each Member State must designate a Computer Security Incident Response Team (CSIRT) as a coordinator for coordinated vulnerability disclosure. This coordinator CSIRT serves as a trusted intermediary, facilitating communication between individuals reporting vulnerabilities and the manufacturers or providers of vulnerable ICT products or services.

Roles of the Coordinator CSIRT

The coordinator CSIRT plays a pivotal role in the vulnerability disclosure process. Some of the key tasks assigned to the coordinator CSIRT include:

  • Identifying and contacting relevant entities involved in the disclosure process.

  • Providing assistance to individuals or entities reporting vulnerabilities.
  • Negotiating disclosure timelines and managing vulnerabilities that impact multiple entities.

Anonymous Reporting

To encourage transparency and information sharing, Member States must ensure that vulnerabilities can be reported anonymously to the coordinator CSIRT. The coordinator CSIRT is responsible for diligently following up on reported vulnerabilities while maintaining the reporter's anonymity.

Cross-Border Cooperation

In cases where a vulnerability could potentially impact entities across multiple Member States, the coordinator CSIRTs are mandated to collaborate within the CSIRTs network. This cross-border cooperation is crucial for effectively addressing vulnerabilities that have widespread implications.

European Vulnerability Database

ENISA, the European Union Agency for Cybersecurity, will be tasked with developing and maintaining a European vulnerability database in consultation with the Cooperation Group. This database will serve as a central repository for publicly known vulnerabilities in ICT products or services.

Database Information

The European vulnerability database will contain essential information that will aid stakeholders in assessing and addressing vulnerabilities. Some of the key details included in the database are:

  • Descriptions of the vulnerabilities identified.

  • Information on affected ICT products or services and the severity of the vulnerabilities.

  • Availability of patches or guidance from competent authorities on risk mitigation strategies for disclosed vulnerabilities.

Conclusion

Article 12 of the NIS 2 Directive underscores the importance of coordinated vulnerability disclosure and the establishment of a European vulnerability database to enhance cybersecurity resilience across the European Union. This directive aims to strengthen the overall cybersecurity posture within the EU and mitigate risks associated with potential cyber threats by promoting transparency, collaboration, and timely response to vulnerabilities.

More from: Article 12 vulnerability disclosure Coordinated vulnerability mechanisms Cybersecurity vulnerability coordination NIS 2 Directive disclosure
Back to NIS2-Directive