Product Security and Coordinated Vulnerability Disclosure Process

At Cytiva, we develop technologies to support researchers, academia and biopharma undertake life-saving activities from biological research to developing innovative vaccines, biologic drugs, and novel cell and gene therapies. To achieve this, we uphold core values that define our responsibility to those we serve. Among them: an unwavering commitment to safety and security. Therefore, we believe in continuously improving to address the ever-evolving privacy and cybersecurity landscape.

In response to potential threats to cybersecurity, Cytiva has formed a global product security team to assess vulnerabilities and determine responses within a coordinated vulnerability disclosure (CVD) process. These efforts allow Cytiva to continually learn from vulnerability test information submitted to us by customers and security researchers.

For the latest product detail information, please visit our product security updates section.

Scope

This CVD process applies to the reporting of potential cybersecurity vulnerabilities in Cytiva products only. Cytiva marketing websites, e-commerce sites, and all other non-product systems are out of scope. Please do not engage in unauthorized testing of out-of-scope assets. Examples of out of scope systems include: www.cytiva.com and www.cytiva.com.cn.

For customer support help requests, technical documents and regulatory contacts and notifications, please contact Support.

Contact information and CVD submission process

Potential security vulnerabilities or privacy issues with a Cytiva product should be reported to: [email protected]. We ask that you please refrain from including sensitive information (e.g., sample information, personal data incl. Personal Health Information or Personally Identifiable Information, etc.) as a part of any submissions to Cytiva. Please provide the following information in your submission:

  • Your contact information (e.g., name, address, phone number, and email)
  • Date and method of discovery
  • Description of potential vulnerability
    • Product name
    • Version number
    • Configuration details
  • Steps to reproduce
    • Tools and methods
    • Exploitation code
    • Privileges required
  • Results or impact
  • What happens next

Upon receipt of a potential product vulnerability submission, Cytiva will:

  • Acknowledge receipt of the submission within five (5) business days
  • Work with specialized product teams to evaluate and validate reported findings
  • Contact the submitter to request additional information, if needed
  • Take appropriate action, if needed

Disclaimer

Cytiva considers it a top priority to protect the health and safety, as well as the personal data, of our customers' patients. When conducting your security research, please avoid actions that could cause harm to patients or products. We reserve the right to seek legal remedies in case your actions have caused harm to Cytiva, our products, customers or patients, or other business partners. Note that vulnerability testing could negatively impact a product. As such, testing should not be conducted on active products.

Cytiva reserves the right to modify its CVD process at any time, without notice, and to make exceptions to it on a case-by-case basis. No particular level of response is guaranteed. However, if a vulnerability is verified, we will attribute recognition to the researcher reporting it, if requested. CAUTION: Do not include sensitive information (e.g., sample information, personal data incl. Personal Health Information or Personally Identifiable Information, etc.) in any documents submitted to Cytiva. You are solely responsible to comply with all laws and regulations during your testing activities.

By contacting Cytiva, you agree that the information you provide will be governed by our site's Privacy Policy and Online Terms of Use. Note: When sharing any information with Cytiva, you agree that the information you submit will be considered non-proprietary and non-confidential and that Cytiva is allowed to use such information in any manner, in whole or in part, without any restriction.