Responsible disclosure

Information security is at the heart of what we do, including for our own systems. Even so, weaknesses can occur. If you report one responsibly, we’ll work with you to fix it quickly.

1. How do you report a vulnerability?

Send an e-mail to security@cyberwise.be with the subject “Responsible disclosure”. Include:

• where you found the vulnerability, for example the URL or the system;
• a description of the problem and how to reproduce it;
• your contact details, so we can get in touch if we have questions.

2. What do we ask of you?

• Report the vulnerability as soon as possible after discovering it.
• Do not make the vulnerability public or share it with others until it has been resolved.
• Do not exploit the vulnerability beyond what is needed to demonstrate it. Do not view, change or delete other people’s data.
• Do not carry out attacks that disrupt availability, such as denial-of-service, and do not use social engineering, phishing or physical access.
• After your report, delete all data you obtained through the vulnerability.

3. What can you expect from us?

• We confirm your report within one working day.
• We assess your report, keep you informed of progress and let you know once the problem has been fixed.
• We treat your report and your data confidentially.
• We handle your report in line with the Belgian legal framework for reporting vulnerabilities. You can read more about this below.

4. Outside this policy

This policy applies to the systems and website of Cyberwise. Systems of clients, partners or other organisations fall outside it. Report vulnerabilities in Cyberwise ISMS in the same way.

In Belgium, the Centre for Cybersecurity Belgium (CCB) provides a legal framework for reporting vulnerabilities. You can find more information at ccb.belgium.be.