Product safety
Product Safety and Compliance with the Cyber Resilience Act (CRA)
We design, manufacture, and support storage solutions in Poland, adhering to the highest EU cybersecurity standards.
The actual resilience of devices to threats is a process that begins at the design stage and continues throughout the product’s entire lifecycle. As a European manufacturer of computer memory, industrial, and enterprise solutions, Wilk Elektronik S.A. is developing its processes for the Goodram and IRDM brands in accordance with the stringent requirements of the EU’s Cyber Resilience Act (CRA).
Want to report a potential vulnerability?
If you have noticed behavior or a technical issue that could affect the security of a Goodram or IRDM brand product, please contact us. You don’t need to be absolutely certain – every reasonable report will be verified by our dedicated team of security engineers.
Learn more
We operate in a transparent and structured manner—see what happens to your report after it is sent.
- Receiving the report
The message is registered in our internal secure incident tracking system. - Confirmation of receipt
You will receive a formal confirmation with a case reference number within 3 working days. - Technical verification
Our R&D team analyzes the firmware and replicates the error. If necessary, we will contact you for more details. - Mitigation actions
After confirming the vulnerability, we develop a firmware patch, driver update, configuration change, or security instructions. - Closure and publication
We inform you about the implementation of the fixes. We publish information about the vulnerability (including optional security advisories in CSAF/VEX format) in accordance with the principles of coordinated disclosure.
We are committed to Coordinated Vulnerability Disclosure (CVD). Premature public disclosure of a vulnerability could facilitate a cyberattack before users receive the appropriate security patches.
As part of our CVD policy, we ask that you adhere to the following principles and avoid actions that could:
- Disrupt the continuity of our customers’ products, systems, or services.
- Lead to unauthorized access to user data.
- Cause alteration, damage, or deletion of any third-party data.
- Increase the risk of the vulnerability being exploited before an official fix is released.
The EU’s Cyber Resilience Act (CRA) redefines the responsibilities of hardware and software manufacturers. According to the new regulations, product security must be ensured throughout its entire lifecycle, not just at the point of sale.
What does the CRA mean for you?
- For individual users
Guaranteed access to security patches for the entire expected lifetime of the product (typically a minimum of 5 years) and transparent support procedures. - For integrators and the B2B sector
Our memory’s compliance with the CRA facilitates the certification of your own complex devices and systems and reduces risk throughout the entire supply chain.
Key obligations we fulfill
- Continuous monitoring, management, and reporting of vulnerabilities.
- Providing independent security updates (isolated from functional changes).
- Creating detailed software component documentation (SBOM).
- Incident reporting: Mandatory reporting of actively exploited vulnerabilities to ENISA within a 24-hour timeframe (effective from September 11, 2026).
IT infrastructure security is not just about the technical parameters of the storage medium, but above all, the credibility of its supplier.
Full control over the supply chain
All key design processes, firmware engineering, and hardware assembly take place at our plant in Poland. This prevents the risk of external interference (so-called hardware backdoors).
Data security and GDPR compliance
We operate within the European legal framework, which guarantees the highest level of protection for our business partners’ information.
Direct engineering support
Our industrial and corporate clients have direct contact with the R&D project team, allowing for a swift response in case of any detected incidents.
