Free tools Windows power users keep installed
One-click scans. No signup required.
Under the EU Cyber Resilience Act (CRA), manufacturers must report an actively exploited vulnerability or a severe incident affecting product security through the CRA Single Reporting Platform (SRP). The first report is due without undue delay and within 24 hours of awareness; later reports have separate deadlines. Prepare a record that can be updated as facts emerge, but do not wait for every field to be complete before sending the early warning.
When does the CRA reporting clock start?
The clock starts when the manufacturer becomes aware of an actively exploited vulnerability or a severe incident affecting product security. These are distinct reporting triggers, not a requirement to report every published CVE. The European Union Agency for Cybersecurity (ENISA) defines an actively exploited vulnerability as one for which there is reliable evidence that a malicious actor exploited it in a system without the system owner’s permission. ENISA’s FAQ explains the definitions and reporting workflow.
As an Amazon Associate I earn from qualifying purchases.
A severe incident is a separate event type: an incident with a severe impact on product security. ENISA identifies availability, authenticity, integrity and confidentiality as relevant security properties. Whether a particular product, manufacturer or event falls within the CRA’s scope depends on its facts; the general reporting rules alone cannot determine an individual case.
Manufacturer reporting obligations under Article 14 apply from 11 September 2026. The European Commission says the reporting duty covers products with digital elements made available in the EU, including products already on the market. The Commission distinguishes these reporting requirements from the CRA’s wider obligations. Reporting by open-source software stewards under Article 24(3) begins on 11 December 2027. See the Commission’s CRA reporting page for the deadlines and scope dates.
#1 Best Overall
- Used Book in Good Condition
What are the deadlines, and what starts each one?
Calculate the early-warning and 72-hour deadlines from awareness. The final-report deadline depends on the event branch: for an actively exploited vulnerability it follows the availability of a corrective or mitigating measure; for a severe incident it follows the 72-hour notification.
| Stage | Trigger and deadline | What to know |
|---|---|---|
| Early warning | Without undue delay, and no later than 24 hours after awareness | Send the initial warning; do not hold it for details intended for later stages. |
| Notification | Without undue delay, and no later than 72 hours after awareness | Provide general information and an initial assessment. |
| Actively exploited vulnerability final report | No later than 14 days after a corrective or mitigating measure becomes available | The deadline runs from measure availability, not simply from initial awareness. |
| Severe-incident final report | Within one month after the 72-hour notification | The deadline runs from the notification, not from the incident’s discovery. |
The deadline wording and distinct final-report triggers are set out by the European Commission.
What information do I need to provide when submitting a notification through the SRP?
ENISA uses that question in its FAQ. The answer depends on the report type and stage: relevant fields vary, and not all are required for the 24-hour early warning. Treat the categories below as an internal readiness checklist, not a claim that every item is mandatory at the first submission. Consult ENISA’s SRP FAQ and its linked glossary for current field-level requirements.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesProduct and scope
- Product name and identifiers, plus affected releases or versions.
- Information about distribution or availability in the EU.
- The responsible manufacturer contact.
These details help identify the product and support a case-specific scope assessment; they do not, by themselves, establish that a particular product is in scope.
Rank #3
- The 2024 ERG guide helps satisfy 49 CFR 172.602 DOT requirement. This requirement states that hazmat shipments be accompanied by emergency response info.
- Pocketbook aids in emergency preparedness, planning, and training with ERGs numerically indexed and color-coded to help emergency responders find vital information fast.
- 2024 Updates: The Pipeline and Hazardous Materials Safety Administration (PHMSA) released a comprehensive summary of updates. Most significantly a QR code on the back cover that provides access to critical incident reporting information.
- Other changes for 2024 have been made to continue to provide the most accurate emergency response information to help all front-line persons and all first responders stay safe during transportation emergencies.
- Specifications: 4" x 5 1/2" Pocketbook Size, English, Spiralbound. Copyright 2024.
Awareness timeline
- When and how the organisation first received a credible signal.
- Validation steps and when they occurred.
- Decision-makers involved and the basis for decisions.
Keeping timestamps and source records is a practical internal control for calculating deadlines and explaining how the response developed. It is an operational recommendation, not a quoted statutory field requirement.
Actively exploited vulnerability branch
- A CVE and/or EUVD identifier, if available, and a description of the vulnerability.
- Evidence and general information about exploitation.
- Severity and impact, known malicious actor and general exploit characteristics, where applicable or available.
- Applicable exceptional circumstances.
ENISA identifies these as relevant vulnerability-report fields, with applicability and timing depending on the stage. A vulnerability identifier alone does not establish that the actively exploited vulnerability reporting trigger has been met.
Severe-incident branch
- Description of the incident and affected security properties.
- Product impact and severity.
- Mitigations applied or underway.
- The likely threat or a working root-cause account.
ENISA identifies these as relevant incident-report information. Keep the account updateable as investigation establishes further facts.
Response and follow-up
- Corrective or mitigating measures, including when a measure becomes available.
- Customer or coordination actions, where relevant.
- New information needed for later notifications and the final report.
Recording when a measure becomes available is particularly important for the actively exploited vulnerability final-report deadline.
Best Value
How do you submit a report, and who receives it?
Submit through ENISA’s CRA Single Reporting Platform and select the appropriate coordinator CSIRT. In general, the coordinator is designated in the Member State where the manufacturer has its main establishment. ENISA describes fallback rules for cases where that cannot be determined and for manufacturers with no EU main establishment.
The coordinator receives the notification; it is generally made available to ENISA, and the coordinator shares it with other relevant CSIRTs. A justified cybersecurity-related reason can lead to an exceptional delay in dissemination; that is not the routine route. ENISA explains the reporting route in its SRP FAQ, and the Commission describes recipients on its reporting page.
There is one SRP notification per relevant event. Keep the submission record with the selected coordinator CSIRT, report stage, submission time and information for follow-up. This makes it easier to track later updates without confusing an internal response record with a filed report.
Recommended Free Tools
Can you automate CRA reporting?
An organisation can integrate CRA reporting into its internal workflow, but ENISA says the SRP’s initial release has no API: submissions must be made through the platform interface. Internal automation can help gather evidence, track awareness and measure availability, and prepare draft information; it does not replace submission through the SRP. Platform capabilities and field requirements may change, so check ENISA’s current FAQ and glossary when setting up the process.
Quick Recap
How to prepare without delaying the first warning
- Maintain a live response record. Keep the product, vulnerability, incident and decision information in a form responders can update as facts emerge.
- Separate the two event branches. Track vulnerability evidence and measures separately from severe-incident impact, mitigations and root-cause findings.
- Record awareness and measure-availability timestamps. Use them to calculate the relevant deadlines; the final-report clock differs by branch.
- Identify the likely coordinator CSIRT and submission owner. Confirm the appropriate route for the manufacturer’s circumstances rather than assuming every case uses the same coordinator.
- Send the early warning without undue delay. Submit available information within 24 hours of awareness and continue building the record for the 72-hour notification and applicable final report.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
