Beta programme Become a CRANIS2 beta tester. Sign up with code BETAUSER for a 90-day free trial (30 days plus 60 more) and help shape CRANIS2 before the CRA deadlines. Join the beta

Incident Response Readiness Checklist

Is your incident response process ready for the Cyber Resilience Act? CRA Art. 14 requires manufacturers to report actively exploited vulnerabilities and severe incidents to ENISA within strict deadlines. Use this checklist to assess your readiness across the six phases of an effective incident lifecycle.

CRA Art. 14 ENISA Reporting Deadlines

When you become aware of an actively exploited vulnerability or severe incident:

24 hours — Early warning to the designated CSIRT
72 hours — Vulnerability/incident notification with initial assessment
14 days (vulnerability) / 1 month (incident) — Final report with root cause, impact, and corrective measures

Automate your incident workflow

CRANIS2 provides a structured incident lifecycle — from detection through post-incident review — with automatic ENISA escalation, deadline tracking, AI-assisted report drafting, and a full audit trail.

Manage incidents in CRANIS2