Cyber Security Advisories and Notices

Our goal is to ensure that reported security issues are handled consistently, assessed in a risk-based way, and communicated to customers in a timely and actionable manner. B&R manages cybersecurity vulnerabilities using established industry practices and a structured, transparent process, that has been defined together with ABB and follows a five step vulnerability handling process.

This process describes our first response, our initial triage phase, the root-cause investigation, develop and test remediation measures, and finally communicate the outcome through security advisories. The process is publicly documented and is designed to provide customers with clarity on what to expect at each stage - from initial report to final guidance.

This approach is aligned with recognized product security lifecycle requirements, including IEC 62443-4-1 and the expectations introduced by the EU Cyber Resilience Act (CRA). For customers, this means that vulnerability handling is embedded into our development and maintenance practices, with defined responsibilities, traceable decisions, and repeatable workflows.

When a noteworthy vulnerability affects B&R products, we publish a security advisory that explains, in practical terms:

• which products and versions are impacted
• how the issue can be understood and assessed, including severity and potential impact
• what actions customers should take (for example patches, updates, mitigations, or configuration guidance)
• where to find additional supporting information

B&R security advisories are published on this website and are also made available via the ABB Cyber Security alerts and notifications portal. To support proactive monitoring, the ABB portal provides both human-readable and automated notification options:

• RSS Feed for customers who want to track newly published advisories in standard newsfeed readers
• ROLIE / CSAF feed for customers who want machine-readable advisories that can be consumed by vulnerability management or asset/security tooling.

Using RSS or CSAF-capable software, customers can filter and monitor advisories relevant to their specific B&R products, enabling faster evaluation and response within their own vulnerability management processes.