PSIRT Support policy

This document describes the security support period policy for all Super B products with digital elements, in the context of the EU Cyber Resilience Act (CRA).

Overview

Super B is committed to providing security updates for its products throughout their supported lifetime. This policy defines when security updates are provided, what customers can expect during and after the support period, and how end-of-life is communicated.

This policy applies to all Super B products with digital elements that fall within the scope of the EU Cyber Resilience Act, including but not limited to battery management systems (BMS), software applications, and associated back-end services.

Support Period

The security support period for each Super B product begins on the date the product is first placed on the EU market and lasts for the duration defined below.

The security support period for each product is the longer of:

• The product's warranty period as defined in the Super B Warranty Policy, or
• Five (5) years from the date the product is first placed on the EU market.

This ensures compliance with the minimum support period required by the EU Cyber Resilience Act (Article 13(8)).

The specific support end date for each product is published on the Super B product page and/or the security advisory page at super-b.com/psirt.

What is Covered During the Support Period

During the security support period, Super B will:

• Monitor for known vulnerabilities in the product and its software components (see super-b.com/psirt/process).
• Assess reported and discovered vulnerabilities and determine if a fix or mitigation is required.
• Develop and distribute security updates where technically feasible, following the internal software development and validation process.
• Communicate security issues and available updates to customers through available channels (website, Be in Charge App, release notes, and newsletter where applicable).

Security updates are distributed to customers free of charge during the support period.

Extended Support

After the official support period ends, Super B may continue to provide security updates on a best-effort basis. Such updates are not guaranteed and are provided at the discretion of Super B. Customers will be clearly informed when a product has reached its end-of-support date.

Extended support does not reset or extend the official support period.

End-of-Life Notification

Super B will notify customers of an upcoming end-of-support date no later than twelve (12) months before the support period ends. Notification will be made via:

• The Super B website (super-b.com/psirt or the relevant product page).
• Release notes of the final supported firmware or software version.
• Newsletter communications where the customer has opted in.

After end-of-life, the product page will clearly indicate that the product is no longer receiving security updates.

Product Security Incident Response

Vulnerability reports related to supported products are handled by the Super B Product Security Incident Response Team (PSIRT) in accordance with the Super B Vulnerability Reporting and Handling Procedure: super-b.com/psirt/process.

Reports can be submitted at any time, including after the end-of-support date. Post-support reports will be assessed by the PSIRT, but remediation is not guaranteed for products that have reached end-of-life.

‍