Legal ↔ Cyber interface
This is the page that justifies one site addressing two audiences. It formalises what each team owes the other, with deadlines and formats — because an unformalised exchange becomes, under pressure, an exchange that does not happen.
Cross deliverables
From Cyber to Legal
| Deliverable | Frequency | Format | Deadline |
|---|---|---|---|
| Validated, signed SBOM | Every shipped version | CycloneDX, plus SPDX export on request | D+1 after release |
| Cybersecurity risk assessment | Per product, at every major change | Standard document | Before the pre-market review |
| Annex I traceability matrix | Per product and version | Table | Before the review |
| Vulnerability handling log and VEX statements | Monthly | Platform export | D+5 |
| Security test reports | Per campaign | Dated report | D+10 |
| Description of the update mechanism | Per product | Standard document | Before the review |
| “Actively exploited” qualification | On event | Qualification sheet | H+2 |
| Technical justification of the support period | Per product | Memo | Before the review |
From Legal to Cyber
| Deliverable | Frequency | Format | Deadline |
|---|---|---|---|
| Criticality classification per product | On entry to the catalogue | Signed sheet | Before development starts |
| Assessment route chosen | Same | Sheet | Same |
| Licence policy and lists | Quarterly | Versioned policy | D+5 after the review |
| Licence exception decisions | On request | Register entry | 5 working days |
| Supplier clauses obtained | Per contract | Extract from the clause set | On signature |
| Decision on SBOM disclosure | Per product | Decision | Before placing on the market |
| Reporting decision and approved wording | On event | SRP form | H+20, for submission at H+24 |
| Support period committed | Per product | Register | Before placing on the market |
The two critical deadlines
Two rows determine compliance with Article 14, and deserve to be displayed:
H+2 — Cyber passes the qualification to Legal. H+20 — Legal returns the decision and approved wording. H+24 — the early warning is sent.
Any other arrangement of these intervals pushes the uncertainty into the final hours, which is the worst possible moment.
Shared vocabulary
Five terms the two teams use differently, whose common definition must be written down:
| Term | Cyber sense | Legal sense | Agreed definition |
|---|---|---|---|
| Vulnerability | Any weakness a tool detects | An exploitable weakness creating risk | A weakness in a component; its exploitability is qualified separately by a VEX |
| Incident | Any security alert | An event to be notified | An event that actually compromises product security; “severe” is a separate qualification |
| Product | A repository, a service, an artefact | What is placed on the market under your brand | What is placed on the market, within the meaning of Article 3 |
| Version | A build identifier | A commercial reference | Both, explicitly linked in the register |
| Support | Operational maintenance | The support period under Article 13 | Always say which: “commercial support” or “regulatory support period” |
The table looks trivial. It prevents incidents where one team says “the product is supported” while the other hears “you have a legal obligation to supply fixes”.
The escalation path
Where disagreement persists on a qualification, a reporting decision or a VEX arbitration:
- Head of PSIRT and legal lead, within two hours during an incident.
- CISO and general counsel, within four hours.
- Executive sponsor, within eight hours.
- If unresolved within the intervals compatible with the legal deadline: the default rule applies — report, do not place on the market, do not lift the block.
The default rule is what makes escalation safe: it guarantees that a disagreement never produces a breach through inaction.