Coordinated Vulnerability Disclosure (CVD) Policy

This policy establishes the approach of KONE Corporation and its affiliates ("KONE ") to receiving, handling, and disclosing vulnerabilities in KONE Products with Digital Elements (PDE) and their supporting services. PDE refers to any software or hardware product and its remote data processing solutions, including software or hardware components placed on the market separately. In KONE context, this covers on-site equipment (e.g., elevator controllers, gateways, IoT devices, embedded firmware), associated mobile applications, and remote data processing solutions required for product functionality (e.g., backend services, cloud applications). This definition follows the EU Cyber Resilience Act (CRA), Article 3(1). This policy is intended to apply globally across KONE Corporation and its affiliates, subject to applicable local laws and regulatory requirements. Where local legal requirements impose additional or conflicting obligations, those requirements take precedence. 

KONE welcomes vulnerability reports from external researchers, customers, partners, and other stakeholders regarding KONE PDE and associated services. 

KONE is committed to coordinated vulnerability disclosure and to providing safe harbor for good-faith security research, as described in this policy. 

This policy applies to: 

• KONE products with digital capabilities that are released and used in customer or operational environments 
• Associated software, firmware, mobile applications, APIs, and cloud-based services required for product functionality 

Out of scope: 

• Corporate IT infrastructure, internal enterprise services, and corporate/marketing websites not associated with KONE products 
• Development, staging, and test environments not part of released products 
• Systems or components outside KONE PDE and their associated services 

KONE evaluates whether reported issues fall within the scope of this policy. Reports related to items outside this scope may be redirected or handled through other applicable processes.

This CVD policy is a public commitment by KONE to receive and handle vulnerability reports in good faith, offering assurances that KONE does not or seek to retaliate against reporters acting responsibly and in good faith, while committing to investigate reports, communicate transparently, and coordinate disclosure timelines in order to reduce risk and protect users.
 

KONE asks for coordination to protect users, not for silence. KONE does not require NDAs to submit a report, though KONE and the reporter may voluntarily agree on confidentiality arrangements to support coordinated remediation and disclosure; KONE does not seek to restrict lawful publication. sfjalskfdj

• Reporter: Any individual or organization that notifies KONE of a potential vulnerability.
• Coordinator: An intermediary who may facilitate communication between KONE and other vendors or reporters, especially for multi-party vulnerabilities.
• Manufacturer (KONE): Responsible for remediating vulnerabilities and publishing advisories.
• User: Receives advisories and remediation information to make informed risk decisions.

KONE provides a technically current and usable vulnerability reporting mechanism:

• Email: security@kone.com. Reporters may encrypt their email using the PGP security key.

Reporters may also request confidential handling of their report.

Reporters are encouraged to provide:

• Product or service name and affected version(s)
• Technical description and steps to reproduce
• Proof-of-concept code or evidence
• Impact and severity estimate
• Disclosure plans (embargo/publication timeline)
• Contact information (optional for anonymous reports)
• Any other relevant details to support analysis and remediation

See Appendix A for more details. 

KONE monitors vulnerability information sources relevant to Products with Digital Elements (PDE), including:

• External sources:
  • Public vulnerability databases
  • Published advisories and
  • Vulnerability reports received via KONE’s disclosure mechanisms.
• Supplier ecosystem: Vulnerability disclosures and advisories from suppliers of KONE.
• Internal sources:
  • Security testing
  • Product assessments, and 
  • lifecycle reviews.
• Automated monitoring: Monitoring of third-party and open-source components used within PDE via automated mechanisms (e.g., SBOM-based correlation).

• KONE aims to acknowledge receipt of vulnerability reports within 7 calendar days and provide initial status information where possible.
• If additional information is needed, KONE will contact the reporter using the agreed communication method.

• Initial triage is performed to assess validity, severity, and scope.
• Duplicate reports are identified and consolidated.
• If a report is not considered a vulnerability or in scope of this policy, the reporter is informed.

• KONE maintains open, cooperative dialogue with reporters and stakeholders.
• Status updates, significant new information, and changes to plans are communicated promptly.
• Embargo periods and disclosure timelines are coordinated with reporters and other relevant stakeholders as needed. KONE seeks to agree disclosure timeframes that appropriately balance risk reduction, technical complexity, product safety, supply-chain dependencies, and coordinated disclosure needs.
• KONE does not seek a publication veto.

For multi‑vendor or systemic issues, KONE coordinates directly or via a trusted coordinator (e.g., a national CSIRT) at the reporter’s or our request. Reporters may choose to involve their CSIRT at any time.

KONE publishes vulnerability information in a timely and proportionate manner to help users understand affected products, available remediation, and any actions they may need to take.

For vulnerabilities requiring coordinated public disclosure, KONE may publish a vulnerability advisory containing, as applicable:

• Advisory and vulnerability identifiers, such as a KONE advisory ID, CVE ID, or other relevant identifier)
• Date and time of publication
• Title and overview
• Affected products and versions
• Impact, severity, and remediation steps
• References and contact information
• Revision history and terms of use.
  
  

Vulnerabilities that are discovered internally and addressed through normal product or service development are typically disclosed through release notes or equivalent product/service communication channels, provided this gives users sufficient information about the fixed vulnerability and available remediation.

Where a vulnerability involves external coordination, a reporter, multi-party handling, significant customer impact, or other circumstances requiring formal disclosure, KONE may publish a dedicated vulnerability advisory instead of, or in addition to, release notes.

KONE may credit reporters in advisories if desired by the reporter. KONE’s Bounty program is separate from this CVD policy; participating in or being eligible for that is not required to report a vulnerability.

KONE is committed to providing safe harbor for good‑faith security research. If you:

• Report promptly, avoid privacy harm, do not extort, and limit testing to the minimum needed to demonstrate impact; and
• Do not intentionally disrupt KONE services (e.g., no DDoS, ransomware, or destructive tooling) or access data beyond what is strictly necessary to evidence the issue; then, to the maximum extent permitted by law, KONE will not initiate or support legal action against you, will not refer your activities to law enforcement for investigation, and will not pursue claims under our Terms of Service or similar restrictions for good‑faith CVD activities. We do not require NDAs to submit a report and do not require identity verification; anonymous reports are accepted. Coordination is requested, not coerced.

KONE supports coordinated vulnerability disclosure and seeks to agree reasonable disclosure timelines with reporters and other affected stakeholders.

Target disclosure and remediation schedules are determined on a case-by-case basis, taking into account factors such as vulnerability severity, exploitation risk, customer impact, product safety considerations, technical complexity, supply-chain dependencies, and the need for coordinated disclosure across multiple parties.

KONE aims to maintain open communication throughout the vulnerability handling process and will provide status updates and mitigation information when appropriate.

KONE does not seek a publication veto.

For vulnerabilities affecting products provided or sold in China, KONE handles disclosure in accordance with applicable Chinese vulnerability management requirements. KONE will not publish or facilitate publication of unpublished vulnerability details before a fix or effective mitigation is available, unless the case has been assessed and handled in accordance with applicable Chinese regulatory requirements. Where Chinese regulatory requirements apply, they override the standard coordinated disclosure practices described in this policy.

This policy is reviewed annually and updated as needed to reflect changes in standards, regulations, and KONE practices.

To report a potential security vulnerability affecting a KONE product or solution, please email security@kone.com or follow the Cybersecurity instructions on: https://www.kone.com/global/en/contact-us.html.