Vulnerability disclosure policy

 Toshiba Group collects information about vulnerabilities in our products and services, and evaluates their impact and risk based on this policy to allay any security concerns customers may have so that they will use them with confidence. When a vulnerability is validated, we will properly disclose information about the vulnerability and how to fix it at an appropriate time. We have been participating in the Information Security Early Warning Partnership^*1 and the CVE Program^*2 to promote actions based on this policy.

^*1 　Information Security Early Warning Partnership (IPA)
　　https://www.ipa.go.jp/en/security/vulnerabilities/partnership.html

^*2 　CVE Program
　　https://www.cve.org/

 Toshiba Group collects information about vulnerabilities in our products and services from a wide range of sources. If you discover any vulnerability in our product or service, please contact Toshiba Group’s point of contact for vulnerability information (i.e., Toshiba PSIRT) or vulnerability coordination bodies and report it.

Please include at least the following information in the report:

• Name of the product or service concerned
• Description of the vulnerability and its anticipated impact

Please encrypt the e-mail using PGP.

 After receiving vulnerability information, we will inform reporter of its acceptance within three business days, except during specific holidays. We might refrain from taking any action if we find that the report is not aligned with this policy.

 We will share the accepted vulnerability information within Toshiba Group and investigate it. If we have identified it as a new vulnerability, we will assess its impact and risk. If, as a result of the assessment, we have confirmed the need for vulnerability mitigation, we will work to address the vulnerability and prepare countermeasures. At this time, we will engage with other stakeholders as necessary. If we have determined that it is not a new vulnerability, we will close the investigation upon appropriate communication with the reporter.

 We will properly manage information about vulnerabilities, their countermeasures, and other related matters within Toshiba Group and will not disclose to any third parties before it is published.

 We will communicate properly with the reporter of a vulnerability and give him/her updates on the progress of its investigation and subsequent actions, at least when we:

• have identified a new vulnerability in Toshiba Group’s product or service;
• have changed its view because of investigation or assessment;
• engage with stakeholders other than the reporter;
• prepare to publish a vulnerability report; and
• close a case.

 We may ask the reporter to provide additional information during the above processes. All communications with the reporter will be by email. To prevent unintended leakage of email messages, we may request that emails be encrypted. Toshiba Group shall never sue the reporter of a vulnerability for his/her goodwill reporting and cooperation.

 If the evaluation results indicate that risk mitigation is necessary, Toshiba Group will disclose vulnerability information and mitigation measures through the Toshiba Group website, the Japan Vulnerability Notes (JVN*3), and other appropriate channels. Toshiba Group participates in the CVE Program as a CNA (CVE Numbering Authority). When a vulnerability affecting a Toshiba Group product or service is confirmed, Toshiba Group will determine whether a CVE ID should be assigned in accordance with the rules of the CVE Program. For vulnerabilities determined to be eligible for CVE assignment, Toshiba Group will assign a CVE ID and publish the corresponding CVE Record (the official CVE Program vulnerability record). When vulnerability information is publicly disclosed, the applicable CVE ID will be included in the published advisory. For products and services related to critical infrastructure, or where Toshiba Group determines that specific customers may be affected, individual notifications may also be provided through appropriate business channels.

^*3 　JVN: Japan Vulnerability Notes
　　https://jvn.jp/en/

 We will post our acknowledgment to the people who have contributed to the discovery and fixing of vulnerabilities in the publication after agreement with contributors.