Information Security at Vaisala

Vaisala is committed to protecting the confidentiality, integrity, and availability of information in our products, services, and operations. We maintain a systematic approach to information security and continuously develop our practices to address evolving cybersecurity risks and regulatory requirements.

Vaisala Information Security Policy

Information Security Management

Vaisala operates an Information Security Management System (ISMS) aligned with the international ISO/IEC 27001 standard. Our certified scope covers the design, development, production, sales, and service of instruments, systems, software, and information for weather, environmental, energy, and industrial applications.

View certificate: ISO/IEC 27001 certificate (PDF)

Product Security & Support Period

Vaisala designs and maintains products with digital elements in line with applicable cybersecurity requirements. For applicable products, security updates are provided during the product support period.

Cyber Resilience Act (CRA) Compliance

Vaisala is preparing for and aligning with the EU Cyber Resilience Act. In accordance with CRA requirements:

• Vaisala maintains a single point of contact for vulnerability reporting
• We implement processes for handling and disclosing vulnerabilities
• We report actively exploited vulnerabilities and severe incidents to relevant authorities when required

Under EU regulation, manufacturers must report such vulnerabilities and incidents via designated channels within defined timelines.

IEC 62443-4-1 Secure Product Development Lifecycle

Vaisala aligns relevant product development practices with IEC 62443-4-1, which defines secure product development lifecycle requirements for industrial automation and control system products.

The standard supports a systematic approach to defining security requirements, secure design and implementation, verification and validation, vulnerability management, security updates, and product end-of-life activities.

Coordinated Vulnerability Disclosure Policy

Vaisala follows principles of coordinated vulnerability disclosure to ensure vulnerabilities are handled securely and responsibly.

• We accept vulnerability reports submitted in good faith
• We assess, validate, and prioritize reported issues
• We coordinate remediation and communication with affected stakeholders 

If you believe you have identified a security vulnerability, please report it through our designated contact point: [email protected]

Vaisala informs its customers about the possible security vulnerabilities in the products and delivers the recommendations for the remediation actions. 

NIS2 Compliance

Vaisala monitors and aligns with the requirements of the EU Network and Information Security Directive (NIS2). In certain markets where applicable legislation classifies Vaisala as an important entity, the company complies with the relevant cybersecurity and risk management obligations in accordance with local regulatory requirements.

Other Compliance and Regulatory Requirements

Vaisala complies with a wide range of applicable information security, cybersecurity, and regulatory requirements across its global operations. Due to the nature of these requirements and their applicability to specific customers, markets, or products, further information is provided on a case-by-case basis.

For inquiries related to specific compliance or regulatory requirements, Vaisala should be contacted separately.