GETAC VULNERABILITY RESPONSE POLICY
1. Introduction
Getac Technology Corporation and its subsidiaries (hereinafter referred to as “Getac”) strives to protect customers and strengthen the security, resilience, and trustworthiness of its products, including hardware, software, firmware, and services (collectively “Getac Products and Services”).
We welcome reports of potential security vulnerabilities affecting Getac Products and support Coordinated Vulnerability Disclosure (“CVD”) as an effective means of identifying, assessing, and addressing security issues in a responsible manner.
We value the contributions of security researchers, customers, partners, and other stakeholders who help improve the security of our products and services.
This Policy explains how to report a potential security vulnerability to us, what information may assist our review, what you may generally expect after reporting a vulnerability, and our approach to coordinated disclosure and good-faith security research.
2. Scope
This Policy applies to reports of potential security vulnerabilities affecting Getac Products and, where applicable, associated software, firmware, components, and services managed through our product security processes.
Potential vulnerabilities involving third-party components may also be reported where they impact a Getac Product or Service.
Where appropriate, Getac may coordinate with suppliers, software vendors, platform providers, and other third parties to investigate, validate, remediate, and communicate vulnerabilities affecting Getac Products and Services.
3. How to Report a Vulnerability
If you identify a potential security vulnerability affecting a Getac Product or Service, please report it through one of our designated security reporting channels:
Security Reporting Form
Security Vulnerabilities Reporting ｜Getac
Product Security Email
Getac-PSIRT@getac.com
When reporting through Product Security Email (Getac-PSIRT@getac.com), we encourage you to use encrypted communication to protect the confidentiality of your information. You can encrypt your report using the Pretty Good Privacy (“PGP”) public key provided below:
Getac supports responsible and coordinated disclosure. Information submitted as part of a vulnerability report will generally be treated as confidential prior to coordinated public disclosure.
4. Information to Include in Your Report
To help us evaluate and reproduce the issue efficiently, please provide information that is reasonably available to you, including:
- affected product, model, platform, software version, or firmware version;
- description of the potential vulnerability;
- potential security impact;
- conditions, procedures, or steps required to reproduce or observe the issue;
- proof-of-concept materials, packet captures, or supporting evidence where available.
You may still submit a report even if some information is unavailable.
Please avoid including personal, confidential, or other sensitive information unless it is reasonably necessary to explain the vulnerability. Where sensitive information is necessary, please use a secure reporting method.
5. What to Expect After You Report
The Getac Product Security Incident Response Team (“Getac PSIRT”) coordinates the assessment and handling of reported vulnerabilities impacting Getac Products and Services.
Where valid contact information is available, we aim to acknowledge receipt of a vulnerability report within three (3) business days.
An acknowledgement confirms receipt of the report and does not constitute confirmation of the reported vulnerability.
Reported issues may undergo technical review, validation, risk assessment, and coordination with internal teams and external suppliers where appropriate.
Where practicable, we may provide periodic status updates regarding investigation progress, remediation planning, mitigation guidance, and disclosure activities.
Response and remediation timelines may vary depending on factors such as:
- severity and exploitability;
- product complexity;
- availability of mitigations;
- supplier dependencies;
- potential impact to customers; and
- quality and completeness of available technical information.
6. Coordinated Vulnerability Disclosure
Getac supports Coordinated Vulnerability Disclosure (“CVD”) and encourages researchers to work with us prior to public disclosure of a reported vulnerability.
We will work in good faith to coordinate disclosure timing while taking into consideration:
- vulnerability severity;
- exploitation activity and risk;
- customer impact;
- availability of mitigations or patches;
- third-party coordination requirements; and
- responsible communication to affected users.
The timing and content of public communications may vary depending on the circumstances of the vulnerability and customer protection considerations.
7. Good-Faith Security Research and Safe Harbor
Getac supports good-faith security research conducted responsibly and substantially in accordance with this Policy.
We encourage researchers to:
- conduct testing only to the extent reasonably necessary to identify and demonstrate potential vulnerabilities;
- avoid privacy impacts, service disruption, data destruction, or unsafe operational impacts;
- make reasonable efforts to avoid accessing, modifying, retaining, or sharing sensitive information; and
- promptly notify Getac if unintended access to sensitive information occurs.
If your research results in unintended access to confidential, personal, or proprietary information, please discontinue activities involving that information and notify us promptly.
If you are uncertain whether planned testing could affect production services, customer environments, data, accounts, or third-party systems, please contact us before proceeding.
Where research is conducted in good faith and substantially in accordance with this Policy, Getac does not intend to initiate, recommend, or pursue legal action solely because of such research activity.
Getac recognizes that responsible security research contributes to customer safety and product security. We value the efforts of security researchers and encourage collaboration throughout the vulnerability disclosure process.
If a third party initiates legal action related to activities that Getac reasonably believes were conducted in good faith and in substantial accordance with this Policy, Getac may take reasonable steps, where appropriate, to communicate that such activities were conducted as part of good-faith security research.
8. Security Advisories, Updates, Vulnerability Prioritization, and Communication
Where appropriate, Getac communicates vulnerability information through Security Advisories, customer notices, support communications, Product Change Notifications (“PCNs”), and other relevant channels.
Security communications may include:
- affected products and versions;
- vulnerability descriptions;
- Common Vulnerability Scoring System (“CVSS”) severity ratings;
- potential security impact;
- mitigation guidance;
- available security updates; and
- recommended customer actions.
Getac currently uses the Common Vulnerability Scoring System standard, version 3.1 (“CVSS v3.1”) for vulnerability severity communication and may reference CVSS v4.0 in future communications as industry adoption evolves.
For supported products, security updates and remediation information may be communicated through applicable Getac support resources or other relevant customer communication channels, including:
Windows Products
Windows Security Update
Android Products
Android Security Update
Where a complete fix is not immediately available, Getac may provide interim mitigation recommendations to help customers manage risk.
9. Researcher Recognition
We appreciate the efforts of security researchers who help improve the security of Getac Products and Services.
Getac will not publicly identify a vulnerability reporter without their permission.
If you would like to be recognized, please let us know the name, alias, or organization you would like us to use.
Where appropriate, and with your consent, Getac may acknowledge your contribution in a Security Advisory or other public security communication.
10. Policy Information and Continuous Improvement
Getac continually strives to strengthen its security posture and improve its vulnerability management capabilities.
Our vulnerability response processes are progressively developed and refined with reference to recognized industry practices and frameworks, including:
- FIRST PSIRT Services Framework, developed by the Forum of Incident Response and Security Teams (“FIRST”);
- ISO/IEC 29147 (Vulnerability Disclosure);
- ISO/IEC 30111 (Vulnerability Handling Processes); and
- European Union Agency for Cybersecurity (“ENISA”) good practices guide on Coordinated Vulnerability Disclosure (“CVD”).
Getac may update this Policy from time to time to reflect changes in products, services, reporting channels, legal requirements, industry practices, or operational needs.