Coordinated Vulnerability Disclosure (CVD) Policy
Coordinated Vulnerability Disclosure (CVD) policy in accordance with the EU Cyber Resilience Act (Regulation (EU) 2024/2847).
1. Introduction and Objectives
AMT Rail Road Production BV (hierna: AMT) ontwikkelt en levert producten met digitale elementen voor de spoorsector, waaronder de Trackbot, E-KROL, zelfrijdende railtrailers en diverse gemodificeerde railwerkvoertuigen. Als fabrikant in de zin van de EU Cyber Resilience Act (CRA, Verordening (EU) 2024/2847) is AMT verantwoordelijk voor de cybersecurity van deze producten gedurende de volledige ondersteuningsperiode.
This Coordinated Vulnerability Disclosure (CVD) policy describes how AMT handles reports of vulnerabilities in its products and systems. The policy:
- provides researchers, customers, and third parties with a secure and transparent channel to report vulnerabilities;
- establishes the handling procedure and responsibilities;
- ensures compliance with CRA obligations regarding vulnerability management and the duty to report to ENISA;
- enables AMT to comply with the 24-hour early warning and 72-hour notification obligation for actively exploited vulnerabilities.
The policy is effective as of the date of adoption and applies to all AMT products with digital elements placed on the EU market.
2. Scope
2.1 In scope
This policy applies to vulnerabilities in:
- embedded software and firmware in AMT products (control logic, communication modules);
- the AMT Service App, including backend components and APIs;
- network communication interfaces of AMT products (Wi-Fi, 4G/LTE, external links, remote diagnostics);
- web portals and cloud services offered by AMT under its own name;
- third-party software components that AMT integrates into its products.
2.2 Out of scope
The following matters fall outside this policy and will not be treated as security vulnerabilities:
- social engineering and phishing aimed at AMT employees;
- physical attacks on AMT products or locations;
- Denial-of-Service attacks (DoS/DDoS);
- vulnerabilities in third-party products that AMT has not modified (to be reported to the respective manufacturer);
- vulnerabilities without demonstrable security impact or without reproducible evidence.
3. Reporting a Vulnerability
3.1 Reporting Channel
Report vulnerabilities exclusively and confidentially via the channel below. Do not use public channels.
| Channel | Details |
|---|---|
| Email (primary) | security@amtgroup.nl |
| PGP Encryption | A public key will be announced via security.txt as soon as it is available. |
| security.txt (RFC 9116) | https://www.amtgroup.nl/.well-known/security.txt |
| Language | Dutch, German, or English |
3.2 Content of the Report
Preferably include the following information with the report:
- type and location of the vulnerability and the affected component/version;
- steps to reproduce the vulnerability;
- expected impact (confidentiality, integrity, or availability);
- contact details of the reporter (name and email; anonymity is permitted);
- any Proof-of-Concept or screenshots (only via the encrypted channel).
Incomplete reports will not be rejected but may lead to a longer processing time.
4. Handling Procedure
4.1 Response Times
| Step | Deadline |
|---|---|
| Acknowledgment of receipt to reporter | Within 3 working days |
| Initial assessment (validation + severity) | Within 7 working days |
| Progress update to reporter | Every 14 days |
| Resolution (patch or mitigation) | Target: within 90 days |
| Public disclosure | After fix or after 90 days |
If the 90-day period is exceeded, the reporter will be informed in a timely manner with the reason and a new target deadline. In the event of active exploitation, all deadlines will be shortened in accordance with the CRA reporting obligation.
4.2 Classification (CVSS v3.1)
| Severity | CVSS Score | Handling Period / Action |
|---|---|---|
| Critical | 9.0 – 10.0 | Escalate immediately; patch within 30 days or immediate mitigation |
| High | 7.0 – 8.9 | Escalation within 7 working days; patch within 60 days |
| Medium | 4.0 – 6.9 | Handling within 30 working days; patch within 90 days |
| Low | 0.1 – 3.9 | Include in regular release cycle; within 180 days |
4.3 Process Steps
Upon receipt of a report, AMT follows the steps below:
- Receipt and registration – record report (date, reporter, description, initial CVSS).
- Validation – assessment of reproducibility and impact.
- ENISA check – is there an actively exploited vulnerability or serious incident? If so: the 24-hour early warning and 72-hour ENISA report are initiated.
- Escalation – internal escalation for CVSS 7.0 or higher.
- Resolution – develop, test, and roll out patch or mitigation; proactively inform affected customers.
- Documentation – CVE application if applicable; update technical file and SBOM.
- Disclosure – publish coordinated security advisory in consultation with the reporter.
- Evaluation – lessons learned; address structural causes.
5. Roles and Responsibilities
AMT has assigned the handling of vulnerability reports to a dedicated security team with clear responsibilities:
| Role | Responsibility |
|---|---|
| Security Contact Person | Primary point of contact, registration, and communication with the reporter; coordination of ENISA reports. |
| Technical Team | Validation of the vulnerability; development and testing of patch or mitigation; updating the SBOM. |
| Compliance | Maintaining the technical file; post-handling review; annual policy evaluation. |
| Management | Decision-making in case of serious incidents and authorization of ENISA reports. |
6. Rules for Researchers (Safe Harbor)
AMT values the contribution of security researchers and offers the following guarantees to researchers who comply with this policy:
- AMT will not take legal action against researchers who act in good faith and follow this policy;
- AMT will not inform enforcement agencies about reports submitted in accordance with this policy;
- AMT considers research conducted in accordance with this policy as acting in the public interest.
AMT expects researchers to:
- not access, copy, or modify systems and data of third parties (customers, end users);
- not disrupt production environments;
- report found vulnerabilities exclusively via the channel in Chapter 3 and not disclose them before the coordinated disclosure date;
- use the vulnerability minimally – enough to demonstrate the impact, no more;
- not exploit the vulnerability for personal or financial gain.
Safe harbor does not apply in cases of intentional damage, data theft, or blackmail attempts.
6.1 Bug Bounty
AMT does not currently have a formal bug bounty program and reserves the right to decide on this per individual report. Researchers who report a significant vulnerability may be mentioned in the public security advisory (credits) upon request.
7. Disclosure and Communication
7.1 Coordinated Disclosure
AMT strives for coordinated disclosure in accordance with ISO/IEC 29147 and the NCSC CVD guidelines. Once a fix or mitigation is available, AMT publishes a security advisory. The reporter will be informed of the publication date in advance.
7.2 Maximum Period
If no solution is available after 90 days, AMT may, in consultation with the reporter, decide on limited disclosure including mitigating measures. AMT communicates proactively with the reporter about this.
7.3 CVE Applications
For vulnerabilities that justify a CVE identifier, AMT will apply for a CVE via MITRE or a relevant CNA. The CVE will be included in the security advisory and the SBOM of the respective product.
7.4 Customer Communication
Affected customers and infrastructure managers will be proactively and confidentially informed about vulnerabilities that directly affect them, including available patches or workarounds, prior to public disclosure.
8. CRA Reporting Obligation to ENISA
8.1 Reporting Thresholds
| Situation | Deadline | Report Content |
|---|---|---|
| Actively exploited vulnerability discovered | 24 hours (early warning) | Product, nature of vulnerability, affected versions, initial CVSS, availability of mitigation. |
| Serious incident with impact on product security | 72 hours | Detailed description, affected customers, measures taken, expected recovery time. |
| Final incident report | Within 1 month | Full analysis, root cause, structural measures, CVE number if applicable. |
8.2 Registration and National Authority
As a manufacturer, AMT is registered with the ENISA Single Reporting Platform. Where necessary, AMT also informs the Dutch Authority for Digital Infrastructure (RDI) in accordance with the national implementation of the CRA reporting obligation.
9. Vulnerabilities in Third-Party Components
AMT integrates third-party software components, including the CODESYS runtime and software from specialized suppliers. For vulnerabilities in these components, the following applies:
- AMT actively monitors vulnerabilities in integrated components via CVE feeds (including NVD, CODESYS Security Advisories, and supplier channels);
- in the event of a vulnerability in a supplier’s component, AMT informs that supplier and demands a response within the contractually established periods;
- AMT informs affected customers in a timely manner, even when the fix depends on a third-party supplier.
10. Documentation and Registration
AMT records all vulnerability reports in an internal vulnerability register, including at least: date of receipt and a unique reference number, a description of the vulnerability and the affected products/versions, the CVSS score and classification, the status per process step, the contact details of the reporter (anonymous if desired), the date and form of disclosure, and—if applicable—the ENISA reporting date and the CVE number. The register is part of the CRA compliance file and is kept for at least five years in accordance with the CRA retention obligation.
11. Evaluation and Revision
This policy is evaluated annually, revised after each significant incident or serious vulnerability, adjusted for changes in CRA implementation regulations or ENISA guidelines, and revised in the event of a substantial expansion of the AMT product portfolio.
12. Contact
| Data | Details |
|---|---|
| Security Email | security@amtgroup.nl |
| Website | https://www.amtgroup.nl |
| security.txt | https://www.amtgroup.nl/.well-known/security.txt |
AMT Rail Road Production BV · CVD Policy · Document number AMT-CRA-CVD-001 · Version 1.0 · June 2026 · Classification: Public