Email from a researcher
“I think I found a weakness in your app.” Who reads this, who checks it and when does that person receive a response?
Knowledge & regulation
No marketing claim.
The source alongside it.
This page distinguishes official frameworks, practical delivery and specialist assessment. Victory Consulting is not a regulator, certification body or government authority.
In plain language
What is this exactly?
You sell an app, software, a smart device or an online product. Someone discovers a security problem. You do not want to work out, in that moment, who handles it, what is true and what must be reported.
Victory Consulting makes that route clear in advance. Not by randomly “hacking”, but by giving your team a workable guide, accountable people and a file.
Discuss your situation →Recognisable examples
Issue in an update
Your developer discovers that a recent update may be exploitable. Is it a technical issue, an incident, or does it possibly need to be reported?
Customer asks for evidence
A business customer asks: “How do you handle vulnerabilities?” You want to be able to show a clear policy and process.
Your team gains controlone owner, one route
You can actremediation, communication, evidence
What a good response looks like
Four steps, even if you are not technical.
Not every issue automatically falls under the same law or reporting deadline. That is why a good route always starts with facts, role and impact.
Receive
The report arrives through one clear channel. The reporter receives a proper acknowledgement.
Understand
The team gathers facts: which product, which customer, which risk and what information is still missing?
Decide
The assigned owner decides with the right specialist whether remediation, communication or a report is required.
Record
Decisions, deadlines and remediation are kept in one file. That provides calm and evidence.
Important: the 24- and 72-hour rules do not automatically apply to every business or every bug. We first help organise the right questions, route and necessary specialist assessment.
The legal route
This does not come from an IT blog. It comes from Europe.
The Cyber Resilience Act is European legislation. It does not automatically apply to every business, but may apply to organisations making products with digital elements available on the EU market.
European Unionofficial regulation
EU 2024/2847Cyber Resilience Actrules for digital products on the EU market
Your organisationReady to actif your product and role fall within scope
EUR-LexRead the official legal text ↗European CommissionWhat the CRA means ↗24h / 72hOfficial reporting information ↗
EU Cyber Resilience Act
Regulation (EU) 2024/2847 lays down cybersecurity requirements for products with digital elements made available on the EU market.
Official EU overview ↗Reporting from 11 September 2026
For manufacturers, actively exploited vulnerabilities and severe incidents require an early warning within 24 hours and full notification within 72 hours.
Official reporting deadlines ↗Dutch context
For Dutch cyber resilience and reporting processes, we refer to NCSC guidance and the Cyber Security Act where it applies to the organisation.
NCSC CVD guidance ↗What we do and do not do
Authority lies in a verifiable boundary.
We deliver
- process and role design
- CVD policy, reporting channel and triage flow
- file structure, templates and exercise
- coordination of pre-agreed specialists
Not without specialist engagement
- penetration testing or active system research
- legal opinion or formal conformity declaration
- certification or regulatory statements
- testing outside written authorised scope
Funding & subsidy
No fictional €2,500 discount.
We do not deduct a subsidy from a proposal before a scheme, activity, company and award actually allow it. For this type of service, no general Dutch subsidy was found that we may present as a fixed discount.
Part of the intakeWe check whether a current scheme fits implementation, training or an industry/regional route. Only after written award do we show the net effect.Request eligibility check →