CRA reports have stages. The case should stay easy to check as facts change. A handoff pack shows the next filing person which proof was on hand. It shows which words were approved and what was filed at each stage. Do not rely on the site to copy fields for you.
Anchor the packet in the governing sequence
Both Article 14 tracks start with an early warning. Send it without undue delay and within 24 hours of awareness. A fuller notice follows without undue delay and within 72 hours. The final clock differs by track.
For a flaw under active attack, the final report is due no later than 14 days after a fix or risk step is ready. For a severe event, it is due no later than one month after the 72-hour notice was filed.
At the top of the pack, record the track, basis for awareness, clock math, and choice owner. If the track is in dispute, keep both checks and name the higher owner. Do not hide the doubt in loose text.
Freeze the early-warning basis
Keep the maker, product, event summary, State check, secret-data choice, known risk step, gaps, source proof, and approved words together. Mark each key fact as seen, drawn from proof, or still open.
After filing, attach its proof and lock that copy. Keep the code review in a separate work record. A later fact should create a clear fix or added scope. It must not rewrite what the firm knew at the first due time.
Review changes at the 72-hour handoff
Show the current value next to the old approved value. Mark it kept, fixed, added to, or still open. Require a source and owner for each large change.
For the flaw track, join known product, flaw, attack, and response facts. For the severe-event track, join known event facts, first check, product harm, and response steps. Do not claim more trust than the review supports. State what is open and when it will be checked again.
Make the final trigger visible
The flaw pack needs proof of when a fix or risk step became ready. That event starts the 14-day final span. The severe-event pack needs the 72-hour filing time. The one-month final span starts there.
The final check should compare the cause, product scope, fix, early claims, and user steps. List doubt that is now solved and any key point still open.
Preserve candidate, approved, and filed states
Keep three states for each stage. The draft pack shows the review at handoff. The approved pack shows the words the firm allowed. The filed copy and receipt show what went outside.
Use one in-house case ID for all states. If an authority asks for a fix, save it as a new approved event linked to the filed copy. The record should show what changed, why, who approved it, and which proof shows each handoff. A peer should not need to rebuild chat or email.
Continue this workflow with the 72-hour vulnerability workflow and the 72-hour incident workflow.