Cybersecurity at Bender
Cybersecurity at Bender
Cybersecurity is a top priority for Bender. We therefore continuously monitor relevant developments and threats in the cybersecurity landscape and incorporate these findings into our development processes. Any vulnerabilities identified are investigated promptly and, where necessary, rectified through security updates.
网络安全是本德尔工作的重中之重。因此我们持续监控网络安全领域的相关动态与各类威胁，并将研究发现融入产品开发流程。一旦发现安全漏洞，我们会立刻开展调查，必要时通过安全更新完成漏洞修复。
As a member of the Computer Emergency Response Team (CERT) of the German Electrical Engineering Association (CERT@VDE.CERT)), Bender benefits from the measures, the exchange and the solutions found together with partners. The expert group of IT specialists, which is geared to the interests and requirements of medium-sized companies, reports security gaps, develops solution approaches and provides these to the partners.
作为德国电气工程师协会 CERT 应急响应团队（CERT@VDE.CERT）的成员，本德尔可以共享各类防护措施、行业交流成果以及多方协作产出的解决方案。这支由 IT 专家组成的专家组面向中型企业的利益诉求与业务需求，负责上报安全漏洞、研究修复方案，并向所有合作成员开放成果。
We are thus notified of potential vulnerabilities at the earliest possible stage and can react immediately.
Furthermore, Bender is a member of the Allianz für Cybersicherheit (ACS) at the Federal Office for Information Security (BSI). Regular penetration tests and IT audits are used to check the security standard. They are carried out at regular intervals within the framework of security certifications that reflect the respective level of knowledge. Internal systems are always sealed off according to the current state of the art in order to prevent external access. This prevents malicious code from reaching the devices in all phases of product development.
借此，我们能够尽早获知潜在安全漏洞，并可第一时间做出响应。
除此之外，本德尔还是德国联邦信息安全局（BSI）下属网络安全联盟（ACS）Allianz für Cybersicherheit (ACS)的成员。企业通过定期开展渗透测试与 IT 审计，核验自身安全防护水平。上述测试会配合安全认证周期定期执行，相关安全认证紧跟当下行业技术认知水平。内部系统始终按照最先进的技术标准实施隔离防护，阻挡外部访问。这套防护手段确保在产品开发的全生命周期各个阶段，恶意代码都无法侵入设备。
We welcome collaboration with the security community to identify and address vulnerabilities in our products and systems. The Coordinated Vulnerability Disclosure Policy sets out how we handle reports of security vulnerabilities and what we expect from those who report them.
我们欢迎与安全社区开展合作，共同发现并修复我们产品与系统中存在的安全漏洞。协同漏洞披露政策页面Coordinated Vulnerability Disclosure Policy明确说明了我方处理安全漏洞上报的流程，同时列明了对漏洞上报人员的行为要求。
Vulnerabilities can be reported via the e-mail address psirt@bender.de.
可通过邮箱psirt@bender.de提交安全漏洞报告。
If you want to communicate with us in encrypted form, please use this PGP key.
若希望与我方进行加密通信，请使用该PGP key公钥文件。
Published Vulnerability Reports
Information on the Cyber Resilience Act
关于Cyber Resilience Act的信息
The Cyber Resilience Act (CRA) establishes new mandatory requirements for the cybersecurity of products with digital components. As a manufacturer of solutions for electrical safety and energy availability, we at Bender are committed to implementing these requirements early on and in a sustainable manner.
Starting December 11, 2027, affected products may only be made available in the EU if they have demonstrated CRA compliance. The first reporting requirements for actively exploited vulnerabilities will take effect on September 11, 2026.
CRA(CRA)Cyber Resilience Act为带有数字组件的产品网络安全设定了全新强制性要求。作为电气安全与供电保障解决方案制造商，本德尔致力于尽早、可持续地落实上述合规要求。
自2027年12月11日起，受管控产品只有证明符合 CRA 要求，方可在欧盟市场投放。针对正在被利用的安全漏洞的首批上报义务，将于2026年9月11日生效。
What does this mean for existing products and the product life cycle?
对现有产品以及产品生命周期意味着什么？
For existing products, the CRA means that cybersecurity must be ensured not only at the time of market launch, but throughout the entire product lifecycle. This includes the continuous assessment of risks, the provision of security updates, and the structured handling of vulnerabilities during operation. Our processes are therefore designed to ensure that products can be operated securely over the long term and that we can respond to new threats even after they are in the field.
对于现有产品，CRA 要求网络安全保障不能仅停留在产品上市阶段，而是覆盖整个产品生命周期。具体包括持续风险评估、提供安全更新、在产品使用期间规范化处置漏洞。因此我们的流程设计，旨在保障产品可以长期安全运行，即便产品已经交付现场，我们仍能够应对新兴威胁。
What have we done so far, even though horizontal standards are not yet in place?
在统一横向标准尚未落地前，我们已开展哪些工作？
Even without fully harmonized standards, we already adhere to the fundamental principles of the CRA as well as established best practices. These include, in particular:
尽管配套统一标准尚未完全定稿，我们现已遵循CRA核心原则以及行业成熟最佳实践，重点包括：
This ensures that our products already meet high safety standards today and that future regulatory requirements can be efficiently incorporated.
以上举措保证我们的产品当前已具备较高安全水准，后续新增法规要求也可高效落地。
With this holistic approach, Bender aims to permanently embed cybersecurity in its products while fostering transparency and trust among its customers.
本德尔依托这套整体方案，力求将网络安全固化到产品之中，同时提升透明度，赢得客户信任。