Responsible Disclosure Policy
RMG Messtechnik GmbH

The security of the products, software solutions, and digital services developed and operated by RMG is our top priority. RMG welcomes the responsible reporting of vulnerabilities and security-related incidents by customers, operators, integrators, service partners, security researchers, and government agencies.

This policy applies to all products, firmware components, software products, web applications, communication solutions, and digital services developed and marketed by RMG.

Security vulnerabilities, authentication and authorization errors, privilege escalations, insecure configurations, vulnerabilities in third-party components, indications of active exploitation, opportunities for manipulation, and other security-related observations should be reported.

General support requests, complaints, warranty inquiries, product information, training requests, and sales-related matters should be submitted through the regular service channels.

RMG provides a security portal with a web form. Reports can also be sent to psirt@rmg.com. An OpenPGP key is available for encrypted communication of confidential information.

Reports should, whenever possible, include the product name, version, component status, description, impact, steps to reproduce the issue, log files, screenshots, proof-of-concepts, and contact information.

Anonymous reports are permitted. However, it is recommended that you provide contact information for follow-up questions and coordination.

RMG confirms receipt of a report within five business days. An initial technical assessment is conducted within ten business days. This is followed by a technical analysis, risk assessment, development of countermeasures, notification of the customer, and closure of the report.

RMG supports the coordinated disclosure of vulnerabilities. Reporters are asked to first report a vulnerability to RMG confidentially and to allow a reasonable period of time for investigation and remediation.

Responsible testing and the provision of technical evidence are permitted. Data manipulation, data theft, denial-of-service attacks, social engineering, and interference with customer systems are not permitted.

Reports will be treated confidentially. Personal data will be used solely for the purpose of processing the report and will be handled in accordance with applicable data protection regulations.

Confirmed vulnerabilities may be disclosed through security advisories. These include affected products, versions, risk assessments, impacts, and recommended mitigations.

RMG releases security updates, firmware updates, patches, hotfixes, and technical advisories to address confirmed vulnerabilities.

Depending on the criticality and impact, RMG informs customers, operators, integrators, government agencies, and other stakeholders about relevant risks and available protective measures.

Reporting a vulnerability does not entitle the reporter to compensation, bounties, or other benefits. RMG reserves the right to evaluate and prioritize reported issues.

Product Security Incident Response Team (PSIRT)
​
E-Mail: psirt@rmg.com
Security Portal: https://www.rmg.com/en/security
Security.txt: https://www.rmg.com/.well-known/security.txt