NIS2 compliance guides and resources
Article 14 names 8 documents due now, even for legacy products; Annex I Part II waits until 11 Dec 2027. A CRA template map, plus what a pack can’t cover.
CRA vulnerability handling requirements: Annex I Part II’s 8 duties set no deadline in days. Turn them into a 7-step PSIRT procedure with owners and records.
ENISA single reporting platform, screen by screen: register in six steps, why your deputy waits for CSIRT verification, and the private-draft trap to avoid.
Only one CRA duty applies today, and it reaches products you no longer sell. This CRA compliance checklist splits 25 items into due now vs 11 December 2027.
CRA for non-EU manufacturers: Article 18 makes the authorised representative optional, but Article 14(7)’s four-step ladder fixes which CSIRT gets your report.
CRA and NIS2 dual reporting, step by step: one event, two 24-hour clocks, two portals, worked filing dates and the final-report fields you can write once.
CRA incident reporting for severe incidents: 24h, 72h and one-month reports under Article 14(4), plus the Article 14(8) user notice that has no fixed deadline.
CRA actively exploited vulnerability: the 24-hour clock starts at ‘reasonable certainty’ of exploitation, not CVE publication. 7-question tree, 9 cases.
CRA Article 14: the 24h and 72h clocks run from awareness, but the 14-day and one-month final reports don’t. One worked timeline covers both reporting tracks.
CRA vulnerability reporting template: all 6 Article 14 forms mapped to ENISA’s 41 SRP fields, plus the 72-hour counter that runs from your early warning.
