For supply chain security (Article 21(2)(d) of the NIS2 Directive) you assess your direct suppliers. This page
answers the questions that a supplier assessment questionnaire usually asks, for WKL Database Gateway Manager
and the VBA class WklGatewayClient. What depends on the version is in MANUFACTURER.md and SECURITY.md of
the delivery.
Manufacturer and contacts
Question
Answer
Manufacturer
EMSR DATA, D.O.O., Trg komandanta Staneta 8, 1000 Ljubljana, Slovenia, https://wvds.it
Manufacturer within the meaning of the Cyber Resilience Act
EMSR DATA, D.O.O., also when you get the product through a distribution partner such as DATECpro GmbH
Contact
the email addresses in MANUFACTURER.md
Single point of contact for vulnerabilities
SECURITY.md: report by email to both addresses or by post; in German, English or Slovenian
Vulnerabilities and updates
Question
Answer
How does the manufacturer handle a reported vulnerability?
Record and assess it, fix it in a separate, free fix release, publish a security advisory with the affected and fixed versions, impact, severity and the steps you should take; details in SECURITY.md
Does the manufacturer report actively exploited vulnerabilities to the authorities?
Yes, through the single reporting platform to the coordinating CSIRT in Slovenia (SI-CERT) and to ENISA, under Article 14 of Regulation (EU) 2024/2847: early warning within 24 hours, notification within 72 hours, final report no later than 14 days after a fix or mitigation is available
Support period
each version five years from the month it was delivered; the end for your version is in MANUFACTURER.md. Beta versions are supported until the next beta version, for at most three months; the end is in MANUFACTURER.md
How long does a security update remain available?
at least ten years after it was released or for the rest of the support period, whichever is longer
What does a security update cost?
nothing; a newer version of the same major version requires no changes on your side
How do updates arrive?
as a new delivery (ZIP or Windows Installer package) that you put into the delivery folder; the app and its starter download nothing from the internet (Put a new version in place)
Integrity and composition
Question
Answer
How is the integrity of the installed files checked?
The starter checks every copy of the app against the delivery and starts none that doesn't match
Is the delivery signed?
Partly. The starter Wkl.Bootstrapper.exe, the libraries WKL Forms Object Library and WKL Office JSON, and the ODBC driver with its installation package carry the Authenticode signature of EMSR DATA, D.O.O.; the .NET runtime carries Microsoft's. The app itself (Access file), the ZIP file and the app's Windows Installer packages aren't signed. Distribute the delivery only from a source you trust
Is there a software bill of materials?
If the delivery contains a folder SBOM, it holds the software bills of materials (CycloneDX) of the app, the WKL libraries delivered with it and the ODBC driver
Which components does the delivery include?
the app; the starter WKL Bootstrapper; the libraries WKL Forms Object Library and WKL Office JSON; the ODBC driver “Wkl OData”; a private .NET runtime from Microsoft. The manufacturer of the WKL components is EMSR DATA, D.O.O.
What must the operator provide?
Access from Microsoft 365 or Office LTSC 2024 (full version or Runtime, 32-bit or 64-bit) on the workstation and a running data service WKL Database Gateway
Data
Question
Answer
Does the manufacturer process the operator's data?
No. The app connects only to the data service whose address you enter when signing in, and sends no data to the manufacturer
Are there connections to third parties?
Only when you initiate them: the app sends invitations by email through the workstation's mail program (Send an invitation by email); the data service downloads the geolocation database from DB-IP or MaxMind only if you choose that source (Check sign-ins and their origin). Further connections of the data service are described in its documentation
Where is personal data?
in the administration store and the log file of the data service at your site; on the workstation only settings and intermediate data; overview under Security and privacy
Who is the controller under the GDPR?
the operator of the installation, not the manufacturer
