Sumitomo Drive Technologies

Overview

Sumitomo Heavy Industries, Ltd. and its affiliated companies (hereinafter "SHI Group") is committed to ensuring the security of its products and services and protecting customers from cyber threats.To this end, the Corporate Group collects and discloses information regarding product vulnerabilities.The Corporate Group has established a Product Security Incident Response Team (PSIRT) to address vulnerabilities related to its products.The PSIRT collects information on product security vulnerabilities from various sources and identifies and mitigates risks based on this information.The following types of vulnerabilities are excluded from reporting:Regardless of the content of the vulnerability information (hereinafter referred to as "Vulnerability Information"), the Corporate Group does not offer any rewards (monetary or otherwise) to individuals who report vulnerabilities (hereinafter referred to as "Reporters").5.1 SubmissionThe reporting form is for vulnerability submissions only.Receipt of the report will be confirmed via an acknowledgment email sent to the specified email address within seven calendar days of submission.Please note that responses may be delayed during the Corporate Group’s holiday periods (e.g., New Year, summer holidays, Golden Week).5.2 Initial ResponseUpon receiving a report, the Corporate Group will review the content. If the reported issue is determined to be a new vulnerability, the Corporate Group will promptly notify the Reporter via the specified email address.5.3 Investigation, Response, and DisclosureProgress updates will be provided as necessary. If the issue is confirmed as a new vulnerability, the Corporate Group will coordinate with relevant parties* to determine the disclosure date and publish a security advisory once preparations are complete.Additional information may be requested during the investigation process, and cooperation is appreciated.In responding to vulnerabilities and security incidents, the Corporate Group may collaborate with government agencies as necessary to provide information to customers.Vulnerability information and countermeasures will be disclosed at an appropriate time.If a vulnerability is deemed to potentially affect specific customers, the Corporate Group may contact them individually through its sales channels.The Reporter hereby grants the Corporate Group a worldwide, non-exclusive, royalty-free, sublicensable, and transferable license to use the Vulnerability Information and any associated intellectual property rights. This license includes, but is not limited to, the right to: develop and publish countermeasures and workarounds based on the Vulnerability Information; modify and improve existing products; develop, manufacture, commercialize, sell, and distribute products that have been modified, improved, or newly developed based on the Vulnerability Information.