CVD Portal
← All tools
Free Tool

CRA Vulnerability Disclosure Readiness Check

A 20-question check of your readiness to handle and report vulnerabilities under CRA Articles 13 and 14. Focused on coordinated disclosure, acknowledgment turnaround, ENISA reporting and advisories. For a whole-programme view across all five CRA domains, use the CRA Maturity Assessment.

Last updated 29 August 2026

Key takeaways

  1. The readiness check covers disclosure policy, contact points, acknowledgment turnaround, Article 14 reporting, and supply chain tracking.
  2. Manufacturers must prepare coordinated vulnerability disclosure processes and Article 14 notification procedures before the September 2026 statutory deadline.
  3. Self-assessment readiness evaluations provide directional guidance for remediation priorities rather than formal legal compliance certifications.
  4. Article 13(8) requires policies and procedures to process and remediate reported vulnerabilities, and Article 14 sets the reporting deadlines to CSIRTs and ENISA.
0 of 20 answered0% complete
1.
CVD Policy
Do you have a publicly accessible coordinated vulnerability disclosure (CVD) policy?
2.
CVD Policy
Does your CVD policy include a single, named point of contact (email or portal)?
3.
CVD Policy
Does your CVD policy include a safe harbour statement for good-faith researchers?
4.
CVD Policy
Is your CVD policy linked from your product documentation or website?
5.
48h Acknowledgment
Can your team acknowledge vulnerability reports within 48 hours?
6.
48h Acknowledgment
Do you have a process to receive and triage reports outside business hours?
7.
48h Acknowledgment
Do you maintain an audit trail of all received vulnerability reports?
8.
Article 14 Reporting
Does your team know what triggers an Article 14 notification to ENISA?
9.
Article 14 Reporting
Do you have a documented process for submitting early warnings within 24 hours?
10.
Article 14 Reporting
Do you know which national CSIRT or ENISA platform to submit Article 14 notifications to?
11.
Article 14 Reporting
Can you produce a CVSS severity score during triage?
12.
Supply Chain
Do you maintain a Software Bill of Materials (SBOM) for your products?
13.
Supply Chain
Do you monitor CVE feeds for vulnerabilities in components you use?
14.
Supply Chain
Do you have a process for coordinating with upstream vendors when a third-party component is affected?
15.
Advisories & CSAF
Do you publish security advisories when you release patches for vulnerabilities?
16.
Advisories & CSAF
Do your advisories include CVE identifiers?
17.
Advisories & CSAF
Are your advisories published in CSAF 2.0 format (machine-readable)?
18.
Programme & Discoverability
Has your security team reviewed the CRA Article 13 and 14 requirements?
19.
Programme & Discoverability
Do you have a security.txt file published at /.well-known/security.txt?
20.
Programme & Discoverability
Have you tested your vulnerability disclosure process with a mock report?

Frequently asked

What does this assessment cover?+

The assessment covers five areas. They are your coordinated disclosure policy, your single point of contact, your acknowledgment turnaround, your Article 14 reporting process, and your SBOM and supply chain tracking. Four of the five map to a CRA article. The CRA sets no acknowledgment deadline, so the 48-hour target is a self-imposed service level.

How accurate is the readiness score?+

The score gives a directional indication based on your self-reported answers. It is not a formal audit or legal compliance certification. Use it to identify gaps and prioritise remediation - not as evidence of compliance.

What happens after I complete the assessment?+

You receive a score, a breakdown by CRA obligation area, and specific recommendations. You can sign up for CVD Portal to address the gaps identified - the free tier handles the September 2026 obligations.

How often should I re-run the assessment?+

Run it quarterly as you build out your compliance programme, and again before the September 2026 deadline. The assessment takes about 5 minutes.

Other free CRA tools

Article 14 Deadline CalculatorEnter the date and time you became aware of an actively exploited vulnerability or severe security incident. Get your exact Article 14 notification deadlines for ENISA reporting.security.txt GeneratorGenerate a standards-compliant security.txt file (RFC 9116) for your product or website. Required by the EU Cyber Resilience Act to make your vulnerability reporting contact discoverable.CVSS CalculatorCalculate CVSS 3.1 base scores for vulnerability severity assessment. Includes guidance on whether the score triggers Article 14 notification obligations under the EU Cyber Resilience Act.

Ready to automate your CVD programme?

CVD Portal integrates all these tools and handles your Article 13 and 14 obligations automatically.

Start your free portal →