A CRA reporting decision starts before anyone opens a notification form. The team first has to identify the affected product, establish what is known about exploitation or impact, agree when awareness began and assign the decision. This is the shortest route from an incoming signal to a case another person can review.
Finish this job
Record a reporting route before the clock expires
- 1Identify the affected product and version.
- 2Assess the current facts against the reporting route.
- 3Record the decision, owner, deadlines and evidence.
Open one case for the signal
Start with the affected product, release or version and the event being assessed. Link the original signal instead of copying fragments into several tickets. The case should carry the chronology from the first alert through the reporting decision and corrective action.
This matters because the CRA reporting duties concern actively exploited vulnerabilities and severe incidents affecting the security of products with digital elements. Those routes require different facts, but both depend on a clear product and event record.
Record the awareness time and why it was chosen
An early warning is due without undue delay and, in any event, within 24 hours of awareness. Unless the information has already been supplied, a fuller notification follows within 72 hours.
Teams may have several candidate timestamps: the first customer report, an automated alert, technical confirmation or escalation to security. Preserve the events and record which one the team treated as awareness, who made that call and what evidence supported it.
Give the assessment the facts it needs
Before choosing a reporting route, make these inputs available in the case:
- The affected product, versions and markets.
- What is known about exploitation and the security impact.
- The source and confidence of each material fact.
- Corrective or mitigating measures already available.
- The person who owns the reporting decision.
Close the case with the route and deadlines
Record whether the case follows the actively exploited vulnerability route, the severe incident route or no current CRA notification route. Keep the reason and the interpretation used beside that answer.
The final-report timing then depends on the route. For an actively exploited vulnerability, the final report is due no later than 14 days after a corrective or mitigating measure becomes available. For a severe incident, it is due within one month after the incident notification.
This article explains an operational approach to CRA preparation. It does not replace the Regulation, official guidance or advice for a specific product and organisation.