SAMMY works best on screens 1024px wide or larger.
CRA Framework
Browse CRA Framework
IR: Incident Response
IR: Do you have a defined process for reporting and disseminating information about actively exploited vulnerabilities and severe incidents to users and authorities?
  • A coordinated vulnerability disclosure (CVD) policy is published and provides external reporters with guidance on how to submit security issues, expected response timelines, and conditions for responsible reporting
  • Defined criteria and timelines exist for notifying relevant authorities or coordination bodies about significant security incidents or actively exploited security defects, in accordance with applicable regulatory requirements
  • User notification procedures specify what information must be communicated to affected users, when, and through which channels
  • Post-incident reviews are conducted for high-severity incidents, with documented corrective actions fed back into the risk assessment and security requirements
Not applicable - The activity is not relevant to the product type or architecture.
Not implemented - No structured or repeatable approach exists.
Partially implemented - The activity exists but is incomplete, inconsistently applied, or does not meet all quality criteria.
Fully implemented - A defined and repeatable approach exists and meets the stated quality criteria.
Description

The Cyber Resilience Act (Article 14) imposes strict obligations on manufacturers to notify ENISA of any actively exploited vulnerability within 24 hours of becoming aware of it, followed by a detailed notification within 72 hours, and to inform affected users without undue delay along with guidance on corrective measures. Article 13(6) further requires manufacturers to have a coordinated vulnerability disclosure policy in place. Incident response is where these obligations converge; without a defined, rehearsed process, organizations risk missing regulatory notification deadlines and leaving users exposed longer than necessary.

Define and document a repeatable process for responding to detected security incidents, covering severity classification, owner assignment, containment actions, and post incident review. Publish a coordinated vulnerability disclosure (CVD) policy that provides external reporters with clear guidance on how to submit security issues, expected response timelines, and conditions for responsible reporting. Establish defined criteria and timelines for notifying relevant authorities or coordinating bodies (e.g., ENISA, national CSIRTs) about actively exploited vulnerabilities and severe incidents, ensuring alignment with the notification windows mandated by Article 14.

Ensure that affected users or customers are informed of incidents and, where applicable, provided with actionable guidance on corrective measures they can take. Document and retain all incident reports, notifications, and response actions for traceability and regulatory review. Treat incident response not as a purely reactive capability but as a process that is periodically tested and improved, so that when a real incident occurs the organization can respond within the timelines the regulation demands.