Since 11 September 2026, Regulation (EU) 2024/2847 – the Cyber Resilience Act (CRA) – requires manufacturers of products with digital elements to notify the authorities, within 24 hours, of actively exploited vulnerabilities and severe security incidents affecting their products.
Eximprod Engineering S.A., a member of the Eximprod Group (EPG), has entered this phase with an operational system in place: an approved internal procedure, a dedicated response team, a single reporting channel and tested workflows for every legal deadline.
From legal obligation to operational process
For us, the CRA is not a paper compliance exercise. It is a way of organising product security across the entire lifecycle – from development to the last security update.
The preparation covered:
- Identifying all EPG products with digital elements and recording them in a controlled register, with versions, markets and support periods.
- Defining roles and responsibilities for every stage – from receiving a signal to reporting to the authorities.
- Building the channels through which customers, partners, suppliers and security researchers can report a vulnerability to us.
- Preparing the templates, approval gates and traceability required for the 24-hour, 72-hour and final report deadlines.
- Aligning customer communication – security advisories, update instructions, compensating controls.
Three pillars of CRA readiness at EPG
1️⃣ A single point of contact for product security
Any vulnerability or security incident related to an EPG product is reported to support@epg.ro. The address is monitored every business day, and security-relevant signals reach the PSIRT (Product Security Incident Response Team) the same day.
Our Coordinated Vulnerability Disclosure Policy sets clear commitments towards those who report to us:
- Acknowledgement of receipt within 2 business days
- Initial assessment within 5 business days
- Status updates at least monthly, until resolution
- Remediation and coordinated disclosure within 90 days – sooner where exploitation is confirmed
- Protection for good-faith reports (safe harbour)
2️⃣ Reporting to the authorities within the CRA deadlines
We have defined the exact moment at which we “become aware” of an actively exploited vulnerability or a severe incident – the moment that starts the clock – and built the workflow for each deadline:
- 24 hours – early warning to the coordinating CSIRT (DNSC) and ENISA, through the Single Reporting Platform
- 72 hours – notification with the initial assessment, the measures taken and the measures users can apply
- Final report – no later than 14 days after a fix is available (vulnerabilities) or one month after the notification (incidents)
Every decision, approval and submission is recorded with a timestamp, so that the timeline of a case can be fully reconstructed.
3️⃣ Security across the entire product lifecycle
Reporting is what is visible. What makes it possible happens earlier, in development:
- A secure development lifecycle aligned with IEC 62443-4-1
- A Software Bill of Materials (SBOM) in CycloneDX format for every released version, scanned regularly for known vulnerabilities
- Security updates delivered separately from functional updates, signed and free of charge
- A 10-year support period for EPG software products, with security updates available throughout
Which products it covers
The system applies to EPG’s software products for power grid automation – first and foremost ES200 Virtual RTU, together with ES200 Device Manager, ES200 Dashboard and the associated edge computing applications – used by distribution system operators and integrators in medium- and high-voltage substations and networks.
Why it matters to our customers
EPG products run in critical infrastructure. For the operators who use them, CRA readiness means concrete things:
- A clear contact for any suspected vulnerability or incident
- Publicly committed response times
- Security advisories with exact versions, impact and remediation steps – not generic statements
- The same information given to authorities and customers, with no contradictions
And for customers with their own notification obligations under NIS2, a manufacturer that knows its products and responds quickly is part of their own compliance.
Next step: full conformity by 11 December 2027
The reporting phase is the first step. The full CRA requirements – conformity assessment, technical documentation, the EU declaration of conformity and CE marking for cybersecurity requirements – apply from 11 December 2027. Our transition plan is already under way, product by product.
At EPG, product security does not end at delivery.
Report a vulnerability: support@epg.ro