Vulnerability disclosure policy (CVE)

Objective:

The purpose of this policy is to establish a clear and transparent process for the disclosure of vulnerabilities in ATISoluciones' systems and applications.

Scope:

This policy applies to all employees, contractors, suppliers, researchers and third parties who become aware of any vulnerability in ATISoluciones' systems and applications.

Disclosure Process:

1. Identification of Vulnerabilities:

Any employee, contractor, supplier, third party or researcher who discovers a vulnerability in ATISoluciones' systems and applications must report it immediately to the information security team.

2. Reporting of Vulnerabilities:

Vulnerabilities must be reported to the information security team through the following communication channel, by sending an email to cve@atisoluciones.com.

The report must include complete and accurate details of the vulnerability discovered, including the description, potential impact, detailed steps to reproduce it and any other relevant information.

ATISoluciones will accept security testing that:

Is carried out in a way that protects the security and privacy of all our clients and partners.
Is carried out solely within the scope defined in this policy.
Provides ATISoluciones with full details of the security issue at the time of disclosure.
Gives ATISoluciones the opportunity to take corrective action before the vulnerability is publicly disclosed or disclosed to third parties.
Complies with the applicable laws and regulations governing security testing activities.

3. Assessment and Prioritisation:

The information security team will assess each vulnerability report received to determine its validity and severity.
Vulnerabilities will be prioritised according to their potential impact on the security of the company's systems and information.

4. Communication of the Disclosure:

Once the vulnerability has been assessed and validated, the discoverer will be notified of the outcome of the assessment.
Coordination will take place with the development team or software suppliers to develop and apply the necessary patches or solutions.

5. Disclosure to Clients:

ATISoluciones will give priority notice to all its clients affected by the vulnerability (together with the guidelines to follow to correct or eliminate it) 15 days before its public disclosure, in order to provide a courtesy period for remediation.

6. Public Disclosure:

The vulnerability will be publicly disclosed once the corresponding solutions have been developed and applied, provided that this does not compromise the security of the systems.
Public disclosure will be carried out in a coordinated and responsible manner, following vulnerability disclosure best practices, and will be published at https://www.atisoluciones.com/incidentes-cve

Confidentiality:

All communications relating to the disclosure of vulnerabilities will be handled confidentially, and the identity of the discoverer will be protected if they so request.

Review and Update:

This policy will be periodically reviewed and updated by the information security team to ensure its effectiveness and relevance. ATISoluciones also reserves the right to update it without prior notice.