Vulnerability Management Policy

This policy applies to:

1. Calenix production and non-production applications;
2. application source code and APIs;
3. cloud infrastructure and hosting environments;
4. databases and storage systems;
5. operating systems and system software;
6. third-party libraries, packages and dependencies;
7. container images and infrastructure components;
8. authentication and authorisation mechanisms;
9. integrations with third-party services;
10. administrative interfaces;
11. endpoints and other systems used to operate Calenix; and
12. other technology assets that may affect the security of Calenix or customer data.

Calenix uses a combination of appropriate technical and operational measures to identify vulnerabilities, which may include:

1. static application security testing (SAST);
2. dynamic application security testing (DAST);
3. software composition analysis (SCA);
4. dependency and package vulnerability scanning;
5. infrastructure and cloud security scanning;
6. container and image scanning where applicable;
7. automated security monitoring;
8. code review;
9. penetration testing where appropriate;
10. security assessments of material third-party services;
11. vendor security notifications;
12. security advisories and vulnerability databases;
13. internal security testing;
14. customer or researcher reports; and
15. other credible sources of vulnerability intelligence.

Calenix evaluates security findings based on their potential impact rather than relying solely on automated scanner severity ratings.

Vulnerabilities are assessed using a risk-based approach. Factors may include:

1. technical severity;
2. exploitability;
3. whether exploitation is known or suspected in the wild;
4. affected asset;
5. internet exposure;
6. data affected;
7. privileges required for exploitation;
8. complexity of exploitation;
9. likelihood of exploitation;
10. potential business impact;
11. potential customer impact;
12. availability of compensating controls; and
13. whether the vulnerability affects a critical dependency or service.

Calenix may use industry-standard severity frameworks, including CVSS, as one factor in its assessment.

As a general target, Calenix aims to address vulnerabilities according to the following priority framework:

Critical

Critical vulnerabilities presenting an immediate or significant risk to customer data, authentication, production infrastructure or core service availability should be investigated immediately and targeted for remediation or mitigation as soon as reasonably practicable.

High

High-severity vulnerabilities should generally be remediated or mitigated within [15] calendar days, depending on exploitability and business impact.

Medium

Medium-severity vulnerabilities should generally be remediated within [30] calendar days.

Low

Low-severity vulnerabilities should generally be addressed within [90] calendar days or through normal maintenance cycles.

These timeframes are targets rather than guarantees. Calenix may accelerate remediation where circumstances warrant.

Calenix may establish an accelerated response process for vulnerabilities that:

1. are actively exploited;
2. affect internet-facing systems;
3. affect authentication or authorisation;
4. expose sensitive customer information;
5. permit remote code execution;
6. affect critical infrastructure;
7. affect widely used dependencies; or
8. otherwise present an immediate material risk.

Emergency mitigations may include:

1. disabling affected functionality;
2. restricting access;
3. applying temporary configuration changes;
4. blocking malicious traffic;
5. revoking credentials;
6. deploying emergency patches;
7. isolating affected systems; or
8. temporarily suspending an integration or feature.

Calenix monitors material third-party libraries and dependencies for known vulnerabilities.

Dependencies should be:

1. obtained from trusted sources;
2. version controlled;
3. periodically reviewed;
4. updated when security fixes are available;
5. removed when no longer required; and
6. evaluated before introduction into production systems.

Where an identified vulnerability cannot immediately be patched, Calenix may implement compensating controls and document the associated risk.

Following remediation, Calenix may perform appropriate verification to confirm that:

1. the vulnerability has been resolved;
2. the remediation did not introduce material regressions;
3. affected systems remain operational; and
4. relevant security controls remain effective.

High-risk findings may require additional testing before closure.

If remediation within the applicable target timeframe is not technically or operationally feasible, the responsible team should document:

1. the vulnerability;
2. affected systems;
3. reason remediation is delayed;
4. potential impact;
5. compensating controls;
6. proposed remediation;
7. expected remediation date; and
8. responsible owner.

Material exceptions should be reviewed by an appropriately authorised security or engineering representative.

Calenix welcomes responsible reports concerning potential security vulnerabilities.

Security researchers and other parties may report suspected vulnerabilities to [email protected]

Reports should include sufficient information to reproduce or understand the issue.

Calenix requests that security researchers:

1. avoid accessing or modifying data belonging to other users;
2. avoid service disruption;
3. avoid destructive testing;
4. avoid publicly disclosing a vulnerability before Calenix has had a reasonable opportunity to investigate and remediate it; and
5. limit testing to systems they are authorised to test.

Calenix will evaluate legitimate vulnerability reports and may contact the reporter for additional information.

Engineering and security personnel are responsible for identifying and remediating vulnerabilities within their areas of responsibility.

Management is responsible for ensuring that appropriate resources and risk decisions are available for material vulnerabilities.

Third-party service providers are expected to maintain reasonable security practices appropriate to the services they provide to Calenix.

Calenix periodically reviews its vulnerability management processes and may update this policy as its technology, threat environment, regulatory obligations and security practices evolve.