1 Scope
This page describes how IRS Systementwicklung GmbH handles vulnerabilities in its standard products: software, firmware, drivers and associated services delivered as catalogue products. Our public product overview lists which products these are.
A substantial part of our business consists of customer-specific systems. For these, the arrangements agreed in the respective project take precedence – requirement specifications, customer specifications, maintenance or framework agreements. Reporting channels, response times and support periods are defined individually there and may differ from this page. This page applies to customer-specific systems only as a supplement and only where nothing to the contrary has been agreed. For security-related matters concerning these systems you can contact our security point of contact in section 2 at any time.
Third-party products that we resell or integrate are not covered by this statement. We forward such reports to the respective manufacturer and inform affected customers where we become aware of an impact.
2 Security contact and reporting
Central intake for vulnerability reports, security incidents and security-related enquiries.
To speed up processing, please include: the affected product with version or serial number, a description of the vulnerability and attack vector, steps to reproduce, and your assessment of the impact. Logs, screenshots or a proof of concept are welcome.
What you can expect from us
| Step | Target |
|---|---|
| Acknowledgement of receipt | 3 business days |
| Initial assessment and rating | 10 business days |
| Status update to the reporter | at least every 14 days |
| Coordinated disclosure | normally 90 days after the report, or once a fix is available |
3 Security advisories
Once a vulnerability is confirmed and a remediation is available, we publish a security advisory identified as IRS-SA-YYYY-NNN. It states affected products and versions, severity including CVSS vector, impact, remediation or workaround and, where assigned, the CVE identifier.
A machine-readable RSS feed is available at advisories.xml for your monitoring. Customers with a maintenance or supply agreement are additionally notified directly via their designated technical contact for critical and high severities. Please register a role-based address rather than a personal mailbox for this purpose.
| Advisory ID | CVE | Affected products | Severity | Published | Fixed in |
|---|
No security advisories have been published to date. New advisories appear here and in the feed.
Security updates and updated drivers are available in our download area.
4 Support and vulnerability handling
We define a support period for every standard product: at least five years from the date the respective version is placed on the market, and longer where the expected service life is longer. Within that period we handle vulnerabilities, provide security updates and keep the associated documentation current. We publish the lifecycle status and, where determined, the end-of-support date of each product in the product overview in myIRS.
We announce the end of a support period at least twelve months in advance; after that date the affected version no longer receives security updates. Extensions under individual maintenance agreements are possible. We retain technical documentation and conformity records for at least ten years from placing on the market.
Assessment and remediation
We identify vulnerabilities from internal testing, automated scans, third-party reports and vendor information on the components we use, which we screen continuously against the software bill of materials for each release. To prevent vulnerabilities in the first place, we rely on binding coding standards, four-eyes code review, automated analysis in the build pipeline, and hardening, secure defaults and least privilege from the design stage onwards.
Every finding is rated in the specific product context by CVSS and internal risk assessment and assigned a remediation deadline. Once the fix has been developed and tested, we verify that the vulnerability is fully closed and publish an advisory.
| Severity | CVSS v3.1 | Target fix or workaround | Advisory |
|---|---|---|---|
| Critical | 9.0 – 10.0 | 7 days | immediately, ahead of the fix if needed |
| High | 7.0 – 8.9 | 30 days | with the fix |
| Medium | 4.0 – 6.9 | 90 days | with the next scheduled release |
| Low | 0.1 – 3.9 | next scheduled release | collected in the release notes |
Deadlines start when the vulnerability is confirmed and are targets, not a contractual commitment. We explain deviations to affected customers.
Regulatory reporting obligations
Actively exploited vulnerabilities and severe security incidents in our products are reported under Article 14 of Regulation (EU) 2024/2847 via ENISA's Single Reporting Platform to ENISA and the competent national CSIRT, in Germany CERT-Bund at the BSI. The deadlines are 24 hours for the early warning, 72 hours for the full notification and 14 days after a remediation is available for the final report.
5 Documentation on request
TISAX® assessment
- Scope-ID
- S67WMM
- Scope type
- Standard Scope 2.0.1
- Valid until
- 2029-07-22
- Sites
- Brennberg, Wörth a.d. Donau
We share the results exclusively with authorised TISAX® participants via the ENX portal. Please contact us at security@irs.systems and include your ENX Participant ID so that we can share the results with you.
Integrators embedding our products as components often need further evidence for their own technical documentation. Via security@irs.systems we provide: a software bill of materials in CycloneDX or SPDX format, where available for the product; a product security data sheet covering security functions, interfaces and hardening recommendations; written confirmation of the support period for the version you use; and completed supplier and security questionnaires.
CE marking and the EU declaration of conformity under the Cyber Resilience Act apply to products with digital elements from 11 December 2027. We will add a CRA declaration of conformity once it has been issued.