CRA Article 14 report template: 24-hour, 72-hour and final report

How to use the template

• Pick the track first. The content differs for vulnerabilities and incidents.
• Keep the case header with every report, so the facts behind each submission stay together.
• Write “unknown so far” and an owner rather than leaving a field blank.
• Enter the agreed text in ENISA's Single Reporting Platform, which may ask for more fields than Article 14 lists (for example CVE or EUVD IDs).

Case header

CASE HEADER (internal, keep with every report)
   - Case reference:
   - Manufacturer legal entity:
   - Track: actively exploited vulnerability / severe incident (and why)
   - Became aware (date, time, time zone) and who became aware:
   - How the information arrived:
   - CSIRT designated as coordinator (Art 14(7)) and why:
   - Who submits on the Single Reporting Platform:
   - Corrective or mitigating measure available (vulnerabilities, date and time):
   - Users informed (Art 14(8)): when, how, what we told them:

Template: actively exploited vulnerability

An actively exploited vulnerability is one with reliable evidence that a malicious actor has exploited it in a system without the owner's permission (Article 3(42)). When the vulnerability track applies.

ACTIVELY EXPLOITED VULNERABILITY

1) EARLY WARNING (Art 14(2)(a))
   Due: without undue delay, within 24 hours of becoming aware
   - Product and versions affected:
   - Member States where the product has been made available (where applicable):

2) VULNERABILITY NOTIFICATION (Art 14(2)(b), unless already provided)
   Due: without undue delay, within 72 hours of becoming aware
   - Product and versions affected:
   - General nature of the exploit:
   - General nature of the vulnerability:
   - Corrective or mitigating measures taken:
   - Corrective or mitigating measures users can take:
   - How sensitive we consider this information (where applicable):

3) FINAL REPORT (Art 14(2)(c))
   Due: no later than 14 days after a corrective or mitigating measure is available
   - Description of the vulnerability, including its severity and impact:
   - Information about any malicious actor that exploited or is exploiting it (where available):
   - Security update or other corrective measures made available to remedy it:

Template: severe incident

Article 14(5) treats an incident as severe if it affects, or could affect, the product's ability to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions, or if it has led or could lead to malicious code being introduced or executed. When the incident track applies.

SEVERE INCIDENT HAVING AN IMPACT ON THE SECURITY OF THE PRODUCT

1) EARLY WARNING (Art 14(4)(a))
   Due: without undue delay, within 24 hours of becoming aware
   - Product and versions affected:
   - Is the incident suspected of being caused by unlawful or malicious acts?:
   - Member States where the product has been made available (where applicable):

2) INCIDENT NOTIFICATION (Art 14(4)(b), unless already provided)
   Due: without undue delay, within 72 hours of becoming aware
   - Product and versions affected:
   - General nature of the incident:
   - Initial assessment of the incident:
   - Corrective or mitigating measures taken:
   - Corrective or mitigating measures users can take:
   - How sensitive we consider this information (where applicable):

3) FINAL REPORT (Art 14(4)(c))
   Due: within one month after the incident notification
   - Detailed description of the incident, including its severity and impact:
   - Type of threat or root cause likely to have triggered the incident:
   - Applied and ongoing mitigation measures:

What the template does not cover

• The notice to users. Article 14(8) asks you to inform impacted users, and where appropriate all users, of the issue and of measures they can take.
• An intermediate report. Under Article 14(6) the receiving CSIRT may ask for status updates between the notification and the final report.
• The decision whether a case is reportable at all. That is yours, ideally with counsel.

More on each step: 24-hour early warning · 72-hour notification · final report.

Questions people ask

Is there an official CRA Article 14 report template?

Reports are submitted through ENISA's Single Reporting Platform, whose fields adapt to the notification type and reporting stage. ENISA's SRP Glossary explains each field. This template follows the Article 14 text so you can prepare the content before you open the platform; it is not an official form.

Do I need a separate template for vulnerabilities and incidents?

Yes. Article 14(2) sets the content for actively exploited vulnerabilities and Article 14(4) for severe incidents. The early warning, notification and final report each ask for different information on the two tracks.

Can I paste this template into the Single Reporting Platform?

Use it to prepare and agree the content internally. Then enter it into the fields the platform shows you, and complete any field the platform requires that is not listed here.

Can VexRoute fill the template in for my case?

The free CRA Reporting Desk can. Log a case with its awareness time and product, and download draft text for all three reports with your case details and deadlines filled in.