CASIO Coordinated Vulnerability Disclosure Policy

1. Commitment

Casio Computer Co., Ltd. ("CASIO") is committed to ensuring cybersecurity throughout the entire product lifecycle.

CASIO recognizes product cybersecurity as an essential element of product quality. By providing safe, secure, and reliable products and services, CASIO seeks to earn and maintain customers' trust and confidence.

In accordance with the principles of Coordinated Vulnerability Disclosure (CVD), CASIO welcomes vulnerability reports from security researchers, customers, partners, and other stakeholders. CASIO evaluates, remediates, and discloses security vulnerabilities in a responsible manner.

2. Good Faith Research

CASIO welcomes security research conducted in good faith.

CASIO will not initiate legal action against individuals who

• Conduct research in good faith
• Comply with all applicable laws and regulations
• Avoid actions that adversely affect customers, users, or services
• Limit testing to activities reasonably necessary to validate and document the vulnerability
• Avoid accessing personal information unnecessarily
• Immediately cease testing and notify CASIO they inadvertently access personal data or confidential information
• Avoid activities that may disrupt services, including denial-of-service (DoS) attacks
• Report vulnerabilities directly to CASIO, and refrain from publicly disclosing vulnerability information until CASIO has completed its investigation and made appropriate remediation or mitigation measures available to affected customers and stakeholders (unless earlier disclosure has been agreed with CASIO)
• Cooperate with coordinated vulnerability disclosure efforts.

3. Reporting a Vulnerability

To report a security vulnerability affecting a CASIO product, service, or related component, please contact CASIO through the methods described in the Contact Information section.

CASIO will normally acknowledge receipt of vulnerability reports within one business day.

When submitting a report, please include the following information whenever possible:

• Product name
• Model number
• Software, firmware, or application version
• Description of the vulnerability
• Steps required to reproduce the issue
• Potential impact
• Proof of Concept (PoC), if available
• Whether the vulnerability has already been publicly disclosed
• Contact information (anonymous reports are accepted)
• Date of discovery
• Supporting attachments, if applicable

4. Contact Information and Secure Communication

You can contact CASIO by email: cra@casio.de

CASIO may provide secure communication methods to protect confidential vulnerability information.

Security contact information will be maintained and updated as necessary.

5. Vulnerability Handling Process

CASIO manages reported vulnerabilities through the following process:

• Report: Receipt and registration of vulnerability information.
• Analysis: Verification, technical assessment, severity assessment, and prioritization based on risk.
• Handling: Development and preparation of mitigations, workarounds, or corrective measures, if and to the extent necessary
• Disclosure: CASIO may disclose relevant information to customers and stakeholders once an appropriate remediation measure has been made available, or if disclosure is otherwise necessary to protect users or comply with legal obligations.
• Regulatory Reporting: Where required by law, CASIO may report vulnerabilities or security incidents to competent authorities and cybersecurity agencies and cooperate with them.

6. Coordinated Disclosure

CASIO supports coordinated vulnerability disclosure practices.

In order to protect customers and users, CASIO may delay public disclosure until a security update is available, mitigation measures are available, or customers have had sufficient time to implement protective actions.

CASIO will seek to coordinate disclosure timing with the reporting party.

7. Recognition

CASIO appreciates individuals and organizations that contribute to improving the security of CASIO products and services.

With the consent of the reporting party, CASIO may acknowledge such contributions.

8. Security Advisories

CASIO may publish security advisories when appropriate to inform customers of identified vulnerabilities and available corrective measures.

9. Responsibility

Responsibility for vulnerability assessment, remediation, coordinated vulnerability disclosure, and regulatory reporting rests with CASIO Computer Co., Ltd. as manufacturer.

Any other CASIO group company acting solely as importer, distributor, or sales entity supports these activities as appropriate but is not responsible for manufacturer obligations under applicable cybersecurity laws and regulations.