| ▲ | aboringusername 3 hours ago | |
From what I see [1] if you search for 'undue delay', it's only: > an early warning notification of an actively exploited vulnerability, without undue delay and in any event within 24 hours of the manufacturer becoming aware of it > without undue delay and in any event within 72 hours of the manufacturer becoming aware of the actively > without undue delay and in any event within 24 hours of the manufacturer becoming aware of it > without undue delay and in any event within 72 hours of the manufacturer becoming aware of the incident "Sorry your honour, we only became 'aware of it' 2 years later, pinky promise ;)". So any competant authority would have to prove when they 'became aware of it', whatever the test to pass that threshold means. | ||