For a flaw under active attack, the final clock turns on a fix or way to cut the risk. Article 14 sets the due date no later than 14 days after that step is available.

The date needs proof. Record the step, product, version, and approval state. State where it was offered and the first time a planned user could get or use it. Do not add an unsupported release date while you draft the final report.

Make availability a reviewed event

Open a possible event when the code team says the step is done. Ask the release owner to record approvals and the way it was sent. Name the planned users, affected releases, needed setup, and first proof that it was ready. The report reviewer should approve or reject it as the clock start and say why.

Keep code end, release approval, public post, staged roll out, and user access as distinct times. Save each event and state which one the firm used. If user groups get the step at different times, record each group. Raise the clock question. Do not choose an easy average.

Assemble the final account

The final report describes the flaw, its level, and its harm. It gives known facts about the bad actor. It also gives details of the security update or other fix that was made ready.

Build the account from saved proof:

  • the product range proved at risk;
  • attack proof and its source;
  • the final harm and level check;
  • the fix and proof of release;
  • user steps and proof they were sent; and
  • changes from the 72-hour notice.

Give each part an owner and proof link. The report should show proven scope and the limits of the review. It should not just collect the latest draft text. If facts about the bad actor are not known, save the work done and mark the point as open.

Close discrepancies, not history

Resolve clashes when the proof allows it. If it does not, state the doubt and both sets of proof. Keep the 24-hour and 72-hour reports with the final one. A reviewer can then see how the result grew.

Compare awareness, versions, attack proof, fixes, user steps, and the clock event with those old copies. Explain each large correction. Close doubt with proof or keep it open. Do not erase it.

After filing, keep the approved pack, filed copy, receipt, and clock proof together. More fix work can stay in the live record without changing the old report.

The rule states a clear due span. Yet whether a step is legally “available” can turn on the facts. Ask legal staff to review a complex release plan.

Continue this workflow with the 72-hour vulnerability packet and the measure-availability timestamp.