Security

Sandvik Coromant Web Security Policy

Introduction

At Sandvik Coromant, we take security seriously and are committed to protecting the confidentiality, integrity, and availability of our web services. This policy outlines our approach to web security, the responsibilities of our organization and users, and how security vulnerabilities should be reported and handled.

Security Commitment

We implement industry-standard security measures to protect our web applications and infrastructure, including:

• Secure coding practices to minimize vulnerabilities.
• Regular security assessments and penetration testing.
• Encryption for sensitive data in transit and at rest.
• Multi-factor authentication (MFA) for administrative access.
• Continuous monitoring and incident response processes.

Responsible Disclosure Policy

We encourage responsible disclosure of security vulnerabilities to help us improve our systems. If you identify a security issue, we request that you:

1. Report it promptly – Send details to our security team via the report form.
2. Provide sufficient details – Include steps to reproduce the issue and any potential impact.
3. Do not exploit the vulnerability – Avoid accessing, modifying, or deleting any data.
4. Allow us time to respond – We will acknowledge your report within 10 business days and provide updates on remediation progress.
   We appreciate the efforts of security researchers and ethical hackers who follow these guidelines.

Prohibited Activities

To maintain a secure and stable web environment, the following activities are strictly prohibited:

• Unauthorized access to systems, data, or accounts.
• Automated scanning or penetration testing without explicit approval.
• Exploiting vulnerabilities for malicious purposes.
• Disrupting or interfering with our services.

Incident Response and Mitigation

If a security incident occurs, Sandvik Coromant follows a structured incident response process:

1. Detection & Analysis – Identify and assess the scope of the incident.
2. Containment & Mitigation – Implement immediate security measures to limit impact.
3. Remediation & Recovery – Fix vulnerabilities and restore normal operations.
4. Post-Incident Review – Analyze root causes and improve security controls.

Continuous Improvement

Security threats evolve, and so do our defenses. We regularly review and update our security policies, conduct training for our teams, and adopt best practices to enhance our web security posture.

Report a security issue

• Please provide at least a description of the incident.
• You can leave the name and email fields empty or use a pseudonym if you would like to remain anonymous.
• Please also state in the report form whether you accept/do not accept that we show your contribution to a Wall of thanks on our website.