These are process requirements
Annex I Part I is about the properties of the product — how it authenticates, how it encrypts, what its attack surface is. Annex I Part II is about what you do for the whole support period after it ships.
The practical consequence is that you cannot satisfy Part II with a snapshot. A clean vulnerability scan today evidences nothing about whether you have a process. An authority asking about Part II is asking to see the process.
The eight points
| Point | Requirement | Evidence that satisfies it |
|---|---|---|
| 1 | Identify and document components and vulnerabilities, including an SBOM. | A CycloneDX or SPDX SBOM generated per release, plus a vulnerability register. |
| 2 | Remediate without delay; security updates separate from feature updates where technically feasible. | Written remediation targets by severity, and evidence of security-only patch releases on maintained branches. |
| 3 | Apply effective and regular tests and reviews. | CI scanning configuration and results, a code review policy, and any external testing — on a schedule, with the output kept. |
| 4 | Publicly disclose fixed vulnerabilities once an update is available. | Published advisories giving the description, affected versions, severity and remediation. |
| 5 | Put in place and enforce a coordinated vulnerability disclosure policy. | A published policy at a stable URL, with response times you actually meet. |
| 6 | Provide a contact address for reporting vulnerabilities. | A monitored security address, plus a security.txt per RFC 9116. |
| 7 | Securely distribute updates. | Signature verification on the client before an update is applied, and key custody arrangements. |
| 8 | Disseminate patches without delay and free of charge, with advisory messages. | Evidence that security updates reach all users at no cost, regardless of support contract. |
Point 8 deserves a second look at your commercial terms
Point 5 says "enforce"
The wording is "put in place and enforce a policy on coordinated vulnerability disclosure". Publishing a policy you do not follow satisfies the first limb and fails the second.
The practical advice is to publish response times you can hit on your worst week, not your best. A 72-hour acknowledgement you always meet is worth more than a 24-hour one you miss.