Article 14 has two report triggers. One covers a flaw under active attack in a product. The other covers a severe event that harms product security. A choice not to report should show how the proof was tested on both routes.

Do not close with one line such as “not severe” or “not under attack.” It does not show which versions or proof were checked. It also hides the fact that would change the choice.

Record each trigger test

For the flaw route, ask two things. Is the flaw in the product? Is there sound proof that a bad actor used it without the system owner’s leave?

For the event route, compare the product security harm with each severe-event test.

For each route, save the result, reviewer, time, proof links, guesses, and open clashes. If the test is not done, mark it open. Missing proof does not mean the trigger is absent.

Preserve contrary evidence

Include the strongest proof in favour of a report. Do not keep only the facts that support closure. For the flaw route, save attack reports and open product-link points. State any limit on trust in the source. For the event route, save harm that was seen or could occur under each test.

Explain why proof for a report did not change the result at that time. It may cover another product, code out of reach, an approved test, or a source with no support. Link the proof for that split.

Keep “trigger not met” apart from “cannot decide.” The first is a choice based on checked proof. The second needs an owner, next source, and review time.

Define a reopen condition

List the new facts that would need a fresh check. These may prove a version, show a real attack, change the harm, or fix the event timeline. Name an owner to watch for them while the case is live.

Give each reopen fact a source and time span. A vendor update, product map, user report, or new code result should reach the same case owner. When it does, open a new check event. Do not edit the old negative choice.

Before closure, use a reviewer who did not write the first check. They should test both trigger sheets, proof for a report, and reopen rules. They must be able to name the key facts and what would change the result.

The goal is not paper for its own sake. It lets a later peer see the limits of the first check and act fast when facts change.

Continue this workflow with the conflicting-exploitation review and the voluntary-reporting decision.