CRA-policy

This policy is part of Transtronic’s work with secure development and cybersecurity risk management in accordance with applicable regulatory requirements, including the EU’s Cyber Resilience Act (CRA).

High security and reliability are crucial for rock drilling equipment. Transtronic continuously works to secure our products. We welcome reports of potential vulnerabilities from security researchers, customers, and users to collectively protect the industrial environment. This policy describes how to report a vulnerability to us and what response you can expect.

Scope

This policy applies to all digital components developed and supplied by Transtronic, including:

• Hardware and firmware for our CANopen-based angle sensors.
• CAN master devices (hardware, operating system and application software) for collecting and presenting drilling data.
• Proprietary protocol implementations and related configuration tools.

Out of Scope

The following are normally outside the scope of this policy:

• Vulnerabilities in third-party products or services not developed or provided by Transtronic.
• Social engineering attacks (e.g. phishing) against our staff.
• Physical attacks requiring unauthorized access to company premises or vehicles.
• Reports of weak passwords or default configurations that cannot be verified or do not affect the security of our delivered products.
• Denial-of-Service tests (DoS/DDoS) or other aggressive scans that risk disrupting our customers’ active operations.

How to report a vulnerability

If you discover a vulnerability, please send your report to our central security point of contact:

• • Web form: https://transtronic.se/en/form-cra/

Please include the following in your report:

• Product name and model (e.g. angle sensor model X or CAN master Y).
• Firmware or software version.
• A detailed description of the vulnerability.
• Step-by-step instructions or code (Proof of Concept) to reproduce the issue.
• Potential system impact (e.g. disruption of data collection, manipulation of drilling data, CANopen communication or other unauthorized impact on system functionality).

Our commitment and expected response times

When we receive a report, we handle it promptly and professionally according to the following objectives:

• Acknowledgment of receipt: We strive to acknowledge receipt of your report within 3 working days.
• Initial feedback: We strive to provide an initial evaluation and status update within 10 working days.
• Ongoing dialogue: We keep the reporter informed throughout the handling process until a remediation is available.
• Coordinated publication: We inform affected customers and publish a security advisory on our website. We are happy to credit you as the reporter if you wish.

Handling of third-party components

Our products may contain hardware components, operating systems or software libraries from external vendors. If a reported vulnerability concerns such a third-party product or component, we may need to coordinate with the affected vendor before information is shared publicly. Our goal is to coordinate this in a way that minimizes the risk to the end user.

Guidelines for reporters (Safe Harbor)

Transtronic will not initiate legal action against security researchers who in good faith follow this policy, avoid causing harm and allow us the opportunity to remediate the vulnerability before public disclosure.

To ensure a safe collaboration, we ask you to:

• Avoid harm: Do not test vulnerabilities on equipment in active production or on machines where incorrect values could cause physical injury.
• Protect data: Do not read or manipulate more data than is absolutely necessary to demonstrate the vulnerability.
• Give us time: Do not share information about the vulnerability publicly before we have had reasonable time to develop and distribute a security update.

Thank you for helping us keep the rock drilling industry safe.

Document information

• Version: 1.0
• Published: 8 September 2026
• Last updated: 8 September 2026