CRA 24h / 72h Reporting Readiness Preflight

A named owner has checked the current CRA reporting scope for the affected product

Use the current Commission and Regulation text for the live scope decision. This checklist does not decide whether a product or event is legally reportable.

The first reliable awareness timestamp and supporting evidence are preserved

The 24-hour and 72-hour reporting windows run from awareness, so retain the timestamp and evidence trail rather than reconstructing it later.

Confirmed facts, product impact and unresolved assumptions are separated

Keep observations distinct from hypotheses. Do not use this tool to decide whether a vulnerability is actively exploited or an incident is severe.

A 24-hour early-warning owner and escalation path are assigned

Know who can assemble the early warning and who can approve or escalate it without waiting for a perfect investigation file.

A 72-hour full-notification owner and evidence-collection path are assigned

Identify the technical and operational owners who can expand the initial report with the fuller facts required after the early warning.

The CRA Single Reporting Platform route and organisational access are known

Use only the official CRA reporting route. Do not paste exploit details, credentials or confidential incident evidence into this checklist.

Final-report ownership, corrective-measure dates and retained submission evidence are planned

The Commission describes later final-report deadlines. Track corrective measures, dates, owners and proof of the submitted reporting trail.