Chapter II, Article 5 · Commission Implementing Regulation (EU) 2024/2981

Contents

Article 5Incident and vulnerability management#

1.National certification schemes shall contain incident and vulnerability management requirements in accordance with paragraphs 2 to 9.

2.The holder of a certificate of conformity of a wallet solution and of the electronic identification scheme under which it is provided shall notify their certification body without undue delay of any breach or compromise of the wallet solution, or of the electronic identification scheme under which it is provided, that is likely to impact its conformity with the requirements of the national certification schemes’ requirements.

3.The holder of a certificate of conformity shall establish, maintain and operate a vulnerability management policy and procedures, taking into account the procedures set out in existing European and international standards, including EN ISO/IEC 30111:2019.

4.The holder of the certificate of conformity shall notify the issuing certification body of the vulnerabilities and changes affecting the wallet solution, based on defined criteria on the impact of these vulnerabilities and changes.

5.The holder of the certificate of conformity shall prepare a vulnerability impact analysis report for any vulnerability that affects the software components of the wallet solution. The report shall include the following information:

(a)the impact of the vulnerability on the certified wallet solution;

(b)possible risks associated with the proximity or likelihood of an attack;

(c)whether the vulnerability can be remedied using available means;

(d)where the vulnerability can be remedied using available means, possible ways to remedy the vulnerability.

6.Where notification is required in paragraph 4, the holder of the certificate of conformity shall transmit, without undue delay, the vulnerability impact analysis report referred to in paragraph 5 to the certification body.

7.The holder of a certificate of conformity shall establish, maintain and operate a vulnerability management policy meeting the requirements set out in Annex I to the Cyber Resilience Act^note.

8.National certification schemes shall establish vulnerability disclosure requirements applicable to certification bodies.

9.The holder of a certificate of conformity shall disclose and register any publicly known and remediated vulnerability in the wallet solution or in one of the online repositories referred to in Annex V.