No supplier's security notification page mentions the Cyber Resilience Act.

The brief

You are between two hundred and a thousand people, somewhere between Brussels and Groningen, in scope for NIS2, and your IT estate still fits on two pages. Windows laptops and Microsoft 365. A dozen Macs for the people who asked for them. Ubuntu on the servers. A Fortinet firewall at each site, Cisco switching in the main one. SAP for finance, Confluence and Jira for everything else. Network cameras in the buildings and building controls from Siemens. HP printers on every floor and a Synology box in a cupboard that nobody will admit to buying.

Matteo Ferri's runbook of 26 October set out what you now have to do about that estate, and his second step is the one that costs a morning: for each supplier, find the place a notice about an actively exploited vulnerability would actually arrive. He is right that the Act gives the duty and no deadline, and right that a page on a website is not a notification. This piece is that step done for eleven suppliers, so that you can see the shape of the answer before you spend the morning.

It is not for you if you hold a premium support contract with a named engineer at each of these companies: you already have a channel and it is a person. Nor if your estate is mostly software your own staff wrote, which is not somebody else's product and about which nobody owes you anything.

The method, and the four things I recorded

I opened each vendor's own pages in a browser and read them. Where a page claimed a channel, I followed the link; where the link was a feed, I fetched the feed and looked at what came back and at the date on the newest item. Nothing here rests on a search result, a comparison site or a vendor's blog post about its own compliance.

For each supplier, four facts in the same order:

1. Whether there is a channel a customer can subscribe to and receive, as against a page somebody updates.
2. What it is: mailing list, feed with a URL, portal notification, or nothing found.
3. Whether reaching it needs an account or a support contract.
4. Whether the vendor's published material mentions the Cyber Resilience Act or Article 14(8) at all.

What this does not establish, and it is the important part. I subscribed to nothing. I asked nobody anything. I have not seen an Article 14(8) notice from any of these eleven and I make no claim about whether any of them is honouring the duty. A vendor with an exemplary mailing list may be notifying nobody. A vendor with nothing visible from outside may be ringing every affected customer within the hour. What is compared here is only what a customer can find and join today — which is narrower than compliance, and checkable, which compliance from this desk would not be.

Two housekeeping points. None of the eleven companies named here has a sponsorship running on this site, and none has ever had one; if that changes, this page will say so at the point the vendor is discussed, and the order will not move. And the list is mine. It is not a sample, not a market survey and not weighted by anything. I picked an estate I have seen in three organisations and wrote down the vendors in it.

What fell out before I opened anything

Vendors whose product reaches you only as a service. Whether the Act covers a thing you never install is a question worth a piece of its own, and it is not this piece; including them would have meant resolving it in a parenthesis.

Open-source projects with no company behind them. The duty in Article 14(8) lands on a manufacturer, and a volunteer upstream is not one. Canonical is in the list precisely because it is the commercial party between you and that upstream.

Resellers and integrators, however much of your estate they touch. Your contract may well be with one of them. The notification duty is not.

And anything I would have had to create an account to look at. Four of the eleven have a gate, and I have recorded the gate rather than going through it, because the gate is the finding.

The eleven, and what is actually there

• Siemensbuilding and industrial controls

  Mailing list by email to ProductCERT with a set subject line, plus an Atom feed and a CSAF feed. No account. The only machine-readable one here.

• CanonicalUbuntu

  Atom feed, RSS feed and the ubuntu-security-announce list, all three named on the notices page itself. No account.

• ApplemacOS and iOS

  The security-announce mailing list, open to anyone without an account. The old address 404s and the working one is linked from the page where you report a bug.

• Axis Communicationsnetwork cameras

  An email subscription form on the notification page. No account. The form is served from the marketing-automation host, on a page promising no marketing.

• MicrosoftWindows and Microsoft 365

  One RSS feed, linked from the Security Update Guide, live and open. A sign-in sits beside it and what that adds is not established.

• Ciscoswitching and routing

  An open PSIRT feed that the advisory listing does not link to, and an email alert service that needs a login.

• Synologystorage

  One RSS feed, linked from the advisory page, live. No list, no email, no account.

• HPlaptops and printers

  Nine category feeds holding the last 90 days. The email alerts link on the bulletins page returns 403.

• Fortinetfirewalls

  A live PSIRT feed that the PSIRT page does not mention. You reach it through a footer index of 23 feeds.

• AtlassianJira and Confluence

  An Alerts list for critical advisories only, behind an account. The one link offered redirects to a purchasing login.

• SAPfinance

  Nothing found from outside. No feed, no list, no email offer; the notes are in SAP for Me and that redirects to a sign-in.

Not one of the eleven notification pages mentions the Cyber Resilience Act, Article 14(8) or the duty to inform users. Four of the companies publish a page about the Act somewhere else on the same website, and none of those pages names the channel the company would use.

The gap is not that they are breaking the law

Take the last point carefully, because it is the one most likely to be misread.

Nothing in Article 14(8) requires a vendor to mention Article 14(8). A manufacturer could run the best service in Europe and never print the words, or print them everywhere and notify nobody. The absence is not a breach and I am not calling it one.

It is still the finding, for two reasons. The first is that four of these companies have gone to the trouble of publishing a page about the Act — Cisco has a solution brief, Canonical has a landing page, Siemens and SAP have programme pages — and not one of those pages says where a notice would go. Cisco's brief sets out the 24-hour and 72-hour clocks owed to the authorities and stops; the duty owed to you is not in it. Canonical's FAQ does reach the duty, and renders it as informing users "within a reasonable timeframe", which is a standard that appears nowhere in the Article. The Article states no period at all. A reasonable timeframe is what a vendor would like the period to be.

The compliance page and the notification page are written by different departments, and neither of them has read the other.

The second reason is practical. When you reach step 6 of Matteo's runbook and email a supplier to ask where they will send an Article 14(8) notice, you want to know whether the person who receives that email will recognise the reference. On the evidence of eleven websites, the security team has not been told to put it anywhere a customer can see.

A feed satisfies the runbook and still tells nobody

Matteo's step 2 accepts three answers: a mailing list, a feed with a URL, or a portal that sends email. By that test nine of eleven pass and two fail, and if you stopped there you would write a satisfied line in your register for Microsoft, Cisco, Synology, Fortinet and HP.

I would not. A feed is a thing you have to go and read. Somebody has to put it into a reader, or a connector, or whatever the security team uses, and then somebody has to look at the reader. That is not a notice arriving; it is a notice whose delivery you have built yourself, at your own cost. The duty is on the manufacturer to inform you. A feed moves the work of being informed onto you and leaves the vendor able to say, accurately, that the information was published.

So the five feed-only vendors are not non-compliant and they are not equivalent to the four that will put a message in a mailbox. On a Thursday afternoon in March, when something is being exploited, the difference between those two is whether anybody is woken up.Which is also why step 5 of the runbook is the one worth doing properly. A feed nobody polls and a mailing list going to an address nobody opens fail in exactly the same way, and only one of them looks like a failure.

The verdict, with the situation attached

For the brief at the top — an organisation of a few hundred people with no premium contract, wanting a notice to land somewhere a named person reads it — the order is this.

Siemens first, and it is not close. A mailing list you join with one email, an Atom feed for the tooling, and a CSAF feed for anyone who wants the advisory as data rather than as prose. No account, no contract, and the only machine-readable channel in the eleven. The company that makes the least software here has the best answer about software, which tells you who has been coordinating vulnerabilities longest.

Canonical second. Three channels, all named on the page you would land on, no account. It loses to Siemens only on the CSAF feed and on the fact that its own page about the Act invents a timeframe.

Apple third, and first if your constraint is that you need a push channel for a fleet you do not centrally manage. The list is open to anybody, it exists to do exactly this job, and the reason it is third is discovery: the old subscription address returns a 404, and the working one is reachable from the page where you report a vulnerability to Apple rather than from the page where Apple publishes them. Somebody doing step 2 in a hurry will conclude the list is gone. It is not gone.

Axis fourth. One form, no account, and the page says plainly what it will send. The deduction is small and I will make it anyway: a page that promises the address will not be used for marketing should not collect it through the marketing platform.

Microsoft fifth, as the best of the feed-only answers, because the feed is linked from the page you would actually find and it works.

Cisco sixth. The feed is live and the advisory listing does not link to it, which costs a procurement officer twenty minutes and makes them conclude there is nothing. The email service exists and wants a login.

Synology seventh, for one working feed, honestly signposted, from a vendor whose products in your estate are the ones nobody inventoried.

HP eighth. Nine feeds where one would do, each holding ninety days, and a subscription link on its own security page that returns 403. The feeds work. The thing HP tells you to click does not.

Fortinet ninth. The feed is current and good. It is not mentioned on the PSIRT page, and you reach it through a footer link into an index of twenty-three feeds, most of which are signature database updates. A reader doing this in good faith will miss it, and on a perimeter device that is the wrong place to hide the channel.

Atlassian tenth. An Alerts list that covers critical advisories only, with everything else left to the issue trackers, behind an account, reached by a link that lands on a purchasing login.

SAP eleventh, with nothing to be had from outside. The patch day page has no feed, no list and no email offer, and the notes are behind a sign-in.

Now the part that matters more than the order. If you already hold an S-user and a Cisco account, this ranking is wrong for you. The gate costs you nothing, SAP and Cisco move up, and your real question is whether the notification preferences inside those portals are switched on — which, from outside, I could not look at. Whether a logged-in SAP customer gets an email about a new security note is one of the four things in this piece I was not able to establish, and if SAP is your general ledger it is the only line in the table you actually need.

What would change this page

Any of these companies putting the words on the page. Not as a compliance gesture: the useful version is a sentence on the notification page saying this is the channel we will use to inform impacted users under Article 14(8), which turns a morning's archaeology into a lookup and costs the vendor one sentence.

A CSAF feed from a second vendor would move the order too. Siemens is first partly because it is alone, and the moment two of the eleven publish advisories as data the comparison is about something else.

I will rewrite this when the first vendor does either. The version of this page I expect to be writing in spring is the one where HP's subscription link works and Fortinet's feed is linked from its own PSIRT page, because those are two small fixes and somebody will notice them before they notice the Act.