Vulnerability Disclosure Policy

1. Purpose
   This policy establishes the basic principles by which KOKUSAI DENKI Electric Inc. ("the Company") receives, assesses and remediates security vulnerabilities identified in products and services provided by the Company. Based on this policy, the Company aims to ensure the proper handling of vulnerability information and an effective response process, thereby minimizing the impact on users and other stakeholders.
2. Scope
   This policy applies to products and solutions developed, provided, and operated by the Company. However, incidents arising from third party products or services outside the Company's control may be excluded from the scope of this policy.
3. Basic Policy for Handling Vulnerability Information
   The Company maintains policies and procedures to receive, assess, prioritize, and remediate potential vulnerabilities reported from external sources. The Company strives to manage and disclose vulnerability information appropriately, based on the principles of Coordinated Vulnerability Disclosure, while working effectively with relevant stakeholders to address the issues.
4. Vulnerability Reporting Contact
   To ensure safer use of our products, the Company collects vulnerability information regarding its products from both internal and external sources. If you discover a potential vulnerability in a Company product, please contact the Vulnerability Reporting Contact listed at the end of this document. Reports concerning vulnerabilities that have already been publicly disclosed or previously reported may be closed as duplicate reports. To facilitate efficient investigation and response, please provide the following information whenever possible:
   ・Affected product (model, software version, serial number, etc.)
   ・Description of the vulnerability or observed issue
   ・Conditions under which the issue occurs
   ・Steps required to reproduce the issue
5. Response to Vulnerabilities
   Upon identifying a vulnerability, the Company will assess the situation and take appropriate measures, such as implementing fixes, providing workarounds, or issuing security advisories, to ensure the security of our products and services. The Company will also properly manage the status of these responses and continuously strive to prevent recurrence and improve quality.
6. Ongoing Communication
   Following receipt of a vulnerability report, the Company will acknowledge receipt and maintain communication with the reporter, as appropriate, during the vulnerability handling process. The Company may provide updates regarding the status of investigation, impact assessment, remediation activities, and planned public disclosure, as necessary. Where investigation or remediation requires significant time, the Company will share progress updates regularly and strive to ensure the reporter is kept informed of the status of the response.
7. Policy on Public Disclosure
   Following the availability of remediation measures or security updates, the Company may publicly disclose information regarding fixed vulnerabilities. Disclosed information may include product identification information, vulnerability descriptions, affected scope, severity, workarounds, and remediation methods. If the Company determines that public disclosure could facilitate exploitation of the vulnerability, the Company may postpone such disclosure to ensure that users have the opportunity to implement corrective measures. Personal information of the reporter, including name and affiliation, will not be disclosed without prior consent, except where disclosure is required by law. Personal information provided to the Company will be protected in accordance with the Company's Privacy Policy and used solely for vulnerability response purposes.
8. Disclaimer
   The Company does not guarantee compensation for time, expenses, or any other damages incurred in connection with vulnerability investigations or reports. The Company also does not operate a monetary reward program for vulnerability reports. Please note that if verification activities against the Company’s products or services are found to violate applicable laws or infringe the rights of third parties, the Company may take appropriate action.
9. Compliance with Laws and Guidelines
   In operating this policy, the Company will act appropriately in accordance with applicable laws, industry guidelines, and relevant security standards.
10. Policy Revisions
    This policy may be revised as necessary in response to changes in business conditions, technological developments, or legal and regulatory requirements. Any revised version will become effective when published on the Company website.

<Vulnerability Reporting Contact>