SMA Incident Response Processes

The adequate response to vulnerability reports and incidents requires defined and lived processes and a va-riety of measures.

SMA has implemented the following processes:

Separate but jointly coordinated processes:
- CSIR (Computer Security Incident Response) as required by ISO 27001 and
- PSIR (Product Security Incident Response) as required by SMA’s Secure Product Development Life Cycle (SDLC) based on IEC 62443-4-1
Both processes contain detailed flow charts and measures for all process steps
Coordination and control is carried out via a ticket system
Work-daily coordination meeting for new vulnerabilities and incidents
Monthly Process implementation status and process KPI control meetings
Product vulnerabilities and incidents: Provision of reportings and advisories via CERT@VDE (certvde.com)
- in the event of reported vulnerabilities after the availability of a software update or other miti-gating measures as well as
- in the case of incidents based on actively exploited vulnerabilities in SMA products and digi-tal services within 72 hours

The measures implemented by SMA include, among other things:

Establishment of IT and cyber security expert teams (Enterprise IT-Security, Product Cyber Security, Data Protection, IT-Department, representatives of the SMA SOC)
Establishment of a 24/7 Security Operation Center (SOC)
Designation of a central contact person for all vulnerabilities and incident reports
Provision of a functional mailbox for all vulnerabilities and incident reports (information-security@sma.de)
Security-related website including responsible disclosure process information, contact possibi-lity for notifiers of vulnerabilities and incidents as well as listing of security reports and advi-sories (www.sma.de/en/cybersecurity)
Membership at CERT@VDE (certvde.com), an industry organization which supports members in the incident response process, among other things, by taking over communication with notifiers as well as creating advisories and applying for CVEs

Status: 2024