Vulnerability Disclosure Policy

1. Introduction

BIVIS CO., LTD. recognizes that cybersecurity is an important aspect of product quality and reliability. We are committed to identifying, evaluating, and addressing potential cybersecurity vulnerabilities in our Battery Energy Storage System (BESS) products to ensure the security and reliability of our products and services.

2. Scope

This policy applies to all Battery Energy Storage System (BESS) products provided by BIVIS CO., LTD.

3. Reporting Security Vulnerabilities

If you discover a potential cybersecurity vulnerability in our products, please report it through our official website or by contacting our designated security contact.

• • Website: [Company Website]
  • Email: [Security Contact Email]

Please include the following information whenever possible:

• • Product model
  • Software/Firmware version
  • Description of the vulnerability
  • Steps to reproduce the issue
  • Supporting evidence (screenshots, logs, or other relevant information)

All reported information will be handled in accordance with our Privacy Policy.

4. Vulnerability Handling Process

Upon receiving a vulnerability report, we will acknowledge the report and initiate our internal vulnerability handling process.

Our cybersecurity response team will:

• • Review and validate the reported vulnerability.
  • Assess the severity and priority of the vulnerability using the CVSS scoring methodology.
  • Coordinate with the relevant development teams to investigate the root cause and develop corrective actions.
  • Provide status updates to the reporter, when appropriate, throughout the investigation process.
  • Develop and release security updates or mitigation measures as necessary.

5. Security Advisory

When a vulnerability has been confirmed, we will publish appropriate security information through our official website or other customer communication channels. Security advisories may include affected products, affected software versions, recommended mitigation measures, and available firmware or software updates.

6. Responsible Disclosure

We appreciate reports submitted in good faith and request that vulnerability information be kept confidential until an appropriate remediation or mitigation plan has been prepared and communicated.

7. Policy Updates

This Vulnerability Disclosure Policy may be updated periodically. The latest version will always be available on our official website.