Security pros question EU zero-day rule
24 hours is an impossible timetable.<p>When do those even start counting? When I think I&#x27;ve found something, or when I&#x27;m done investigating and confirming it and have completed a technical writeup?<p>The official language can be found starting on page 41 (bottom) of this document:<p><a href="https:&#x2F;&#x2F;eur-lex.europa.eu&#x2F;resource.html?uri=cellar:864f472b-34e9-11ed-9c68-01aa75ed71a1.0001.02&#x2F;DOC_1&amp;format=PDF" rel="nofollow noreferrer">https:&#x2F;&#x2F;eur-lex.europa.eu&#x2F;resource.html?uri=cellar:864f472b-...</a><p>&gt; The manufacturer shall, without undue delay and in any event within 24 hours of becoming aware of it, notify to ENISA any actively exploited vulnerability contained in the product with digital elements. The notification shall include details concerning that vulnerability and, where applicable, any corrective or mitigating measures taken.<p>Doesn&#x27;t sound realistic at all.