The Product Security Incident Response Management Team is a global team, which manages security vulnerability information related to Vitesco Technologies. It is the central point of contact for all security researchers, customers, partners and suppliers, to report security information related to products of Vitesco Technologies.

If you believe you have identified a potential security vulnerability in a Vitesco Technologies Product, please contact us: PSIRM@vitesco.com.

You can also send your documents to: PSIRM@vitesco.com.

 Vitesco Technologies Security & Privacy Competence Center (VT SCC)

 Product Security Incident Response Management (PSIRM)

 Vitesco Technologies Engineering România SRL

 Calea Chișinăului 2A, 700264 Iași, România

Handling Process

1. Reporting

 If you believe you have identified a potential security vulnerability in a Vitesco Technologies Product, please contact us at: PSIRM@vitesco.com.

You can also send your documents to: PSIRM@vitesco.com.

• Vitesco Technologies Security & Privacy Competence Center (VT SCC)
• Product Security Incident Response Management (PSIRM)
• Vitesco Technologies Engineering România SRL
• Calea Chișinăului 2A, 700264 Iași, România

When reporting please provide the following information:

• Name: Please provide your identity details. In case you want to remain anonymous, we would respect your interests
• Contact: Details how to contact you if some more information is required
• Description: Technical details and potential impact of the vulnerability
• Affected components: Information in the most detailed manner and any further publicly available information or a link to it.

2. Verification

As soon as a vulnerability report is received, a tracking number is issued and is provided to the reporter. Then the relevant product responsibles are involved to validate and to understand the potential vulnerability and to assess the risk related to it. Once it is confirmed that one of our products has a vulnerability, we intend to notify our affected customers.

3. Analysis

As next step, a detailed investigation is being made to understand the root cause, possible methods of exploitation and to assess the risk related to it.

4. Mitigation

A remediation plan will be prepared, and a mitigation strategy will be established.

5. Disclosure

We intend to disclose the vulnerability to the Automotive Community. However, this is only done in alignment with all our affected customers. It is important for us that our customers as well as our internal organization gets adequate time to deploy the required mitigation, before any damage could be caused by a disclosure of the vulnerability report.