HOC Shorts
The European Union’s EU Cyber Resilience Act (CRA) vulnerability and incident reporting mandate is officially live. All manufacturers, software vendors, and digital hardware providers placing products with digital elements on the EU market must now report any actively exploited vulnerability or severe security incident to ENISA’s Single Reporting Platform (SRP) within 24 hours of becoming aware.
Failure to comply risks market access restrictions, product recalls, and severe statutory fines reaching up to €15 million or 2.5% of global annual turnover.
What Are the Key Points?
The early enforcement reporting duties establishes a strict, tiered notification schedule for vendors selling connected hardware, standalone software, or IoT devices in the EU:
- The 24-Hour Early Warning: Manufacturers must submit an initial alert to ENISA’s Single Reporting Platform (SRP) within 24 hours of reaching a reasonable certainty that a vulnerability is actively being exploited or that a severe incident has occurred.
- The 72-Hour Detailed Notification: A comprehensive report detailing the event assessment, vulnerability severity, technical impact, and initial mitigations must follow within 72 hours.
- Final Corrective Report: A final disclosure must be filed within 14 days of a fix becoming available for exploited vulnerabilities, or within 1 month for severe security incidents.
- Centralized Routing: Submitting a report via the ENISA SRP automatically routes the notification to the national Computer Security Incident Response Team (CSIRT) of the vendor’s primary EU establishment.
How it works?
[Threat Identified / Exploitation Confirmed]
│
▼ (Within 24 Hours)
[Submit Early Warning to ENISA Single Reporting Platform (SRP)]
│
▼ (Within 72 Hours)
[Submit Detailed Assessment & Technical Mitigation Report]
│
▼ (Within 14 Days of Fix / 1 Month of Incident)
[File Final Corrective Report & Notify Impacted Users]
What Is the Impact on Enterprise & Vendors?
1. Product Security Becomes a Market Access Condition: Compliance is no longer voluntary. Security governance and vulnerability disclosure are now auditable legal prerequisites to maintain EU market eligibility.
2. Massive Financial & Operational Liability: Non-compliance carries fines of up to €15 million or 2.5% of total global annual turnover, alongside mandatory product withdrawals or recalls enforced by market surveillance authorities.
3. Shortened Triage Windows: Engineering, product security, legal, and incident response teams must collapse their internal investigation workflows to meet the aggressive 24-hour determination window.
What Should You Do? (Actionable Steps)
- Designate Assigned Representatives (ARs): Appoint primary and backup representatives responsible for accessing the ENISA Single Reporting Platform (SRP) and ensure their EU Login credentials with MFA are active.
- Map Digital Product Portfolios: Conduct a comprehensive inventory of all software binaries, IoT devices, and digital components currently marketed or distributed within the EU to confirm scope.
- Establish 24-Hour Triage Escalations: Re-engineer product security incident response (PSIRT) playbooks to ensure active exploitation signals are escalated to legal and compliance filing teams within hours.
- Automate Software Bill of Materials (SBOM): Maintain accurate, machine-readable SBOMs for fast dependency mapping when third-party components trigger reporting thresholds.
CRA Reporting Timeline Overview
| Requirement Phase | Mandatory Timeframe | Primary Deliverables | Target Recipient |
| Early Warning Alert | Within 24 Hours | Basic event indicators, exploit confirmation, unlawful activity flags | ENISA SRP / Lead CSIRT |
| Detailed Notification | Within 72 Hours | Impact assessment, severity rating, temporary mitigations | ENISA SRP / Lead CSIRT |
| Final Resolution Report | 14 Days (Vulnerability Fix) / 1 Month (Incident) | Final root cause analysis, permanent security patch, remediation advice | ENISA SRP / Affected Users |
You can download CRA Single Reporting Platform Factsheet
