MRO and Services

Companies worldwide receive thousands of product change notifications (PCNs) and end-of-life (EOL) notifications daily.

 

What could be the possible consequences of these notifications ?
Can we assess the risks involved in a delayed response when handling obsolescence ?

 

To manage these problems, CENTRALP proposes a dedicated service to optimize the life cycle of the customer’s products :

• Active process (real-time monitoring with a worldwide component database) and passive process (manufacturers and distributors).
• Periodic sustainability reports.
• Dedicated action plans in case of obsolescence:
  • Search for a new FFF (Form, Fit and Function) component.
  • New design.
  • Purchase and storage of end-of-life electronic components.
• CENTRALP know how
  • Design, validation and qualification of the new product.
  • Manufacture according to the standards.
  • Documentation update (REACH, ROHS, …) and compliance with the new standards.
  • Technical assistance.
  • Dedicated experts.

The Cyber Resilience Act (CRA) is a European regulation aimed at strengthening the cybersecurity of connected digital products sold within the European Union. It requires manufacturers of software, IoT equipment and connected products to integrate cybersecurity from the design stage (“security by design”), manage vulnerabilities throughout the product lifecycle, and provide security updates.

The CRA entered into force on December 10, 2024, with its main obligations being introduced progressively. Full compliance will be required as of December 11, 2027.

Coordinated Vulnerability Disclosure Policy

At CENTRALP, the security of our products, embedded systems, software and related services is a priority.

We encourage security researchers, customers, partners and certification bodies to report any potential vulnerabilities affecting our products.

How to Report a Vulnerability

Vulnerabilities can be reported to: cybersecurite@centralp.fr

To facilitate our analysis, please provide:

• The product concerned
• The HW reference or version number
• The SW reference or version number
• A detailed description of the vulnerability
• The conditions required to reproduce it
• The estimated impact
• Any relevant technical evidence

Our Commitment

We commit to:

• Acknowledge receipt of the report within 48 hours
• Assess the associated risk
• Implement appropriate corrective measures in accordance with the contractual conditions agreed with the relevant stakeholders
• Keep the reporter informed of the progress of the investigation and remediation process whenever possible

Responsible Disclosure

We ask anyone reporting a vulnerability to:

• Act in good faith
• Refrain from publicly disclosing the vulnerability until a reasonable corrective measure has been implemented or an agreement has been reached with our team

Products Covered

This policy applies to all hardware products, embedded software, firmware and digital solutions developed and marketed by CENTRALP.