ENISA — EU Agency for Cybersecurity

The European Union Agency for Cybersecurity (ENISA), established by the EU Cybersecurity Act (Regulation (EU) 2019/881), is the EU's primary cybersecurity agency. Its mandate includes providing expertise to EU institutions and member states, developing certification frameworks (European Cybersecurity Certification Schemes), producing threat landscape reports, publishing cybersecurity good practice guides, and coordinating the EU's response to large-scale cybersecurity incidents. ENISA's role expanded significantly with the CRA, which assigns it specific operational responsibilities relating to vulnerability notification and the EU vulnerability registry.

Article 14 of the CRA requires manufacturers to notify ENISA when they become aware of a vulnerability in their product that is being actively exploited. The notification timeline is:

• 24 hours — initial notification confirming the vulnerability and exploitation status.
• 72 hours — early warning with preliminary impact assessment and initial mitigations.
• 14 days — final report with full technical details, CVSS score, affected versions, remediation, and fix availability.

ENISA receives these notifications centrally and disseminates relevant information to national CSIRTs and affected operators of essential services. Manufacturers must identify the correct ENISA notification contact (typically the ENISA's vulnerability reporting portal, with CSIRT-to-CSIRT coordination for complex cases).

Article 16 of the CRA tasks ENISA with operating a European vulnerability registry — a centralised EU database of vulnerabilities reported under the CRA. This registry complements (not replaces) the global CVE programme. Key characteristics:

• Manufacturers who report actively exploited vulnerabilities under Article 14 contribute to the registry.
• ENISA coordinates with national CSIRTs to ensure timely information flow to operators of critical infrastructure.
• The registry is expected to integrate with CSAF-based advisory distribution and the CVE ecosystem.
• ENISA publishes aggregated threat intelligence based on registry data in its annual ENISA Threat Landscape report.

Manufacturers should expect the registry to become an important mechanism for demonstrating regulatory compliance with Article 14 obligations.

ENISA publishes substantial guidance relevant to CRA compliance that manufacturers should treat as authoritative reference material:

• ENISA CVD Good Practice Guide — detailed guidance on implementing coordinated vulnerability disclosure policies, PSIRTs, and security advisories.
• ENISA Threat Landscape (annual) — the EU's authoritative threat intelligence report, relevant for threat modelling.
• Guidelines on Security of IoT — security design requirements aligned with CRA essential requirements.
• ENISA SBOM Good Practices — guidance on SBOM generation, maintenance, and use.
• European Cybersecurity Certification Schemes — relevant for Critical product certification.

ENISA guidance does not have the same legal force as the CRA itself, but market surveillance authorities treat it as the regulatory reference standard for assessing compliance quality.