What applies since 11 September
Manufacturers of products with digital elements must report two things: actively exploited vulnerabilities in their products and severe security incidents affecting the security of those products. This applies to controllers, gateways, sensors and software alike.
Important: the duty applies regardless of whether a product was already developed to CRA requirements. It also covers devices placed on the market before the deadline.
The deadlines
- 24 hours after becoming aware: early warning
- 72 hours after becoming aware: notification with first details, severity and affected products
- Final report: for vulnerabilities no later than 14 days after a fix is available, for severe incidents within one month of the 72-hour notification
Where do reports go?
Reports are submitted via ENISA’s central CRA Single Reporting Platform (CRA-SRP). They go to the coordinating CSIRT of the responsible member state and to ENISA. In Germany that is CERT-Bund at the BSI. According to the BSI, no prior registration is required, and it provides step-by-step guides.
Five steps for the coming weeks
- List your products: which of them have digital elements and are on the EU market?
- Build an SBOM: without a bill of software components you cannot tell whether a new vulnerability affects you.
- Create an intake channel: an address for security reports (e.g. security.txt) and a process that checks it daily.
- Assign roles: who assesses, who reports, who informs customers?
- Dry run: play through a fictional vulnerability end to end, with a stopwatch.
How we help
We generate CycloneDX SBOMs straight from your build pipeline, match them automatically against new advisories and set up the reporting process so it works at night too. For new devices we plan secure boot and signed updates from day one.
This article is for general information and is not legal advice.
