Shenzhen Optical Network Video Technology Co., Ltd. (hereinafter referred to as “ONV”) has always regarded cybersecurity as a core foundation of product R&D and corporate strategy. As the European Union prepares for the full implementation of the Cyber Resilience Act (CRA), ONV is fully prepared. We are committed to comprehensively aligning with the CRA’s cybersecurity standards and ensuring that connected digital products sold in the EU market are fully compliant.
In accordance with the requirements of the Act, ONV will strictly comply with the following:
1. From 11 September 2026: fully perform the vulnerability reporting obligations under the CRA.
2. From 11 December 2027: all products placed on the EU market will fully meet all substantive requirements of the Act.
Our cybersecurity best practices are closely aligned with the core principles of the CRA, including Secure by Default, Secure by Design, full lifecycle management, and transparency.
The following are ONV’s specific actions and commitments in relation to CRA compliance:
As a professional switch manufacturer, ONV adopts a comprehensive lifecycle security approach, embedding security protection from the product concept and design stage:
l Hardware and foundational security: Our switch products support Secure Boot and firmware digital signatures, establish a hardware root of trust, and prevent malicious firmware tampering. We also implement strict supply chain security controls to mitigate component contamination.
l Secure default configurations: We eliminate default weak passwords and require users to change the initial password upon first boot; all unnecessary ports and services are disabled by default; and we provide comprehensive support for encrypted management protocols such as SSH, HTTPS, and SNMPv3.
l Network resilience design: Tailored to the characteristics of switches, our products incorporate mechanisms such as CPU protection, protocol packet rate limiting, DHCP Snooping, and Dynamic ARP Inspection to effectively defend against DDoS attacks and LAN intrusions. They support Zero Trust network architectures and role-based access control (RBAC), ensuring high resilience across the data plane, control plane, and management plane.
ONV attaches great importance to vulnerability management throughout the product lifecycle and has established a dedicated Product Security Incident Response Team (PSIRT).
l Vulnerability intake and disclosure: We will develop a responsible vulnerability disclosure policy and maintain close cooperation with security researchers and institutions worldwide.
l Rapid response and patch delivery: We will establish an efficient firmware update mechanism. Once a security vulnerability is identified, we will promptly deliver security patches and mitigation measures to customers through official security advisories, email notification services, and our official website support center, minimizing potential risks to the greatest extent possible.
l vulnerability bounty program: We have established and continuously operate a bug bounty program to encourage white-hat security researchers to assist us in identifying and remediating potential security risks.
Transparency is the foundation for building customer trust. ONV is committed to providing customers with clear and accurate product security information.
l Software Bill of Materials (SBOM): In accordance with CRA requirements, we will provide customers with a standard-format Software Bill of Materials to ensure that open-source and third-party components contained in our products are transparent and traceable.
l Lifecycle support (EOL/EOS): We clearly publish our product support lifecycle (EOL/EOS) policy before sale, enabling customers to clearly understand the security maintenance period of our products and plan network upgrades appropriately.
l Security hardening guidelines: We provide detailed security configuration guides and hardening manuals for all switch products, assisting customers in deploying the highest level of security defense in accordance with their own network environments.
ONV not only relies on rigorous internal penetration testing and threat modeling (with reference to industry-recognized frameworks such as the OWASP IoT Top 10), but also actively engages external parties for objective assessment. We maintain long-term cooperation with internationally recognized third-party security laboratories to conduct independent security audits and vulnerability scans on our switch products, ensuring that known risks are eliminated before delivery.
Cybersecurity is a continuously evolving and dynamic process. ONV is committed to continuing to invest R&D resources, not only to meet the minimum compliance requirements of the CRA, but also to exceed industry security baselines. We provide global customers with vulnerability scanning tools, security configuration training, and incident response guidance. At the same time, we will continue to monitor developments in EU and global cybersecurity regulations to ensure that our compliance strategy remains at the forefront of the industry.
ONV has always been committed to raising the security baseline of network equipment to address an increasingly complex threat landscape.
Date of Issue: 24 September 2026
English▾
Chinese
French
Portuguese
Spanish
Russian
