Cybersecurity

Kässbohrer Geländefahrzeug AG is committed to effectively protecting the security of its products with digital elements, its digital services, and its publicly accessible IT infrastructure. These are collectively referred to below as “systems within the scope of this policy.” To this end, Kässbohrer Geländefahrzeug AG operates a structured process for the receipt, assessment, handling, and coordinated disclosure of reported vulnerabilities. 

We welcome reports from security researchers, customers, partners, CERTs, public authorities, and other members of the security community, provided that such reports are submitted responsibly, confidentially, and in good faith via the reporting channels described in this policy.

As a matter of principle, Kässbohrer Geländefahrzeug AG does not intend to assert civil claims or file criminal complaints against persons who make reports, provided that they act voluntarily, in good faith and in accordance with this policy. This statement does not constitute authorization to carry out unlawful acts and is not binding on any public authorities or other third parties.

This is subject in particular to the person making the report not carrying out any unlawful or damaging acts, not collecting, using, or disclosing any data without authorization, not impairing any systems beyond the extent necessary for verification, and treating information on potential vulnerabilities as confidential until disclosure has been agreed with Kässbohrer Geländefahrzeug AG.

Reports of potential vulnerabilities can be sent by email to the Security Incident Response Team (SIRT) of Kässbohrer Geländefahrzeug AG: cybersecurity@kaessbohrerag.com.

The initial contact by email serves to report a potential vulnerability and to establish a suitable secure communication channel.

In your first email, please provide only the information required to establish contact and make an initial assessment, and do not send any confidential details, personal data, or directly exploitable information.

The SIRT will generally confirm receipt of a report within two business days at the Laupheim site and will provide a secure communication channel for the exchange of confidential information.