CRA Readiness Checklist

Work through the capabilities the Cyber Resilience Act expects, from a published disclosure policy to the Article 14 reporting deadlines. Your progress is saved in your browser. Email or print the result for your compliance file.

CRA readiness

—

Policy and contact

Public vulnerability disclosure policyREQUIRED

A published security.txt and disclosure policy on your website (RFC 9116). CVD best practice per ISO/IEC 29147, supporting Article 13.

Single point of contactREQUIRED

A designated security contact for receiving vulnerability reports.

Secure communication channelREQUIRED

An encrypted channel (for example PGP) for reports from researchers.

Article 14 reporting

24h early warningREQUIRED

Notify ENISA and your national CSIRT within 24 hours of becoming aware of an actively exploited vulnerability (Article 14).

72h detailed reportREQUIRED

Submit a detailed notification within 72 hours of becoming aware of an actively exploited vulnerability or significant incident (Article 14).

Final report, +14 days or 1 monthREQUIRED

Submit a final report within 14 days (actively exploited vulnerabilities) or 1 month (significant incidents), including remediation details (Article 14).

Upstream component reportingREQUIRED

A mechanism to share component vulnerabilities and patches with upstream maintainers (Article 14(6)).

Process and evidence

48h acknowledgment process

Acknowledge receipt of a vulnerability report within 48 hours. CVD best practice per ISO/IEC 29147.

Mitigation documentationREQUIRED

Systematic tracking and documentation of remediation efforts.

Audit trailREQUIRED

A timestamped, exportable record that proves you met each deadline, ready for a market surveillance authority.

Take your results with you

Email yourself a copy or print this page for your compliance file.

CVD Portal gives you the portal, the Article 14 workflow, and the audit trail for free. Create your free portal or see pricing.

Free vulnerability disclosure portal for companies subject to the Cyber Resilience Act.

Product

Features
Pricing
How it works
CRA Readiness Checklist
Documentation
System Status

Legal

Privacy Policy
Terms of Service
GDPR
Trust & Security
Report a vulnerability

Information

Researchers
Industry
Citizens
EU Vulnerability Feed

Company

Why We Exist
Blog
News
Partners
Contact

Operated by Porta Regulus B.V. · Registered in the Netherlands · KvK 42062307 · VAT NL869534208B01 · WTC Amsterdam, Strawinskylaan 1, 1077 XW Amsterdam

LEGAL DISCLAIMER: CVD Portal provides software infrastructure designed to facilitate compliance with the EU Cyber Resilience Act (CRA). Use of this platform does not constitute legal advice. Manufacturers placing products with digital elements on the EU market are responsible for their own legal compliance with the CRA, including the Article 13 vulnerability-handling obligations and the Article 14 reporting obligations. CVD Portal is an independent platform and is not affiliated with, endorsed by, or an official agency of the European Union or ENISA.