The CRA platform is one online point of entry. A maker uses it to tell the main CSIRT and ENISA at the same time. The CRA has narrow cases that can limit ENISA’s access. The main CSIRT will most often share the report with CSIRTs where the product was offered.
“One entry” only describes the filing route. The maker must still choose the right CSIRT and name the Member States at issue. It must also finish each report stage.
Prepare the route before an incident
Apply the rule for the maker’s main site. Record the Member State that results. Name each person who may file and how they can get into the site. Control changes to the account and help notes. The site’s steps may change.
For each filing, save the exact data, send time, site ID, and receipt. If the site stops or rejects it, save the error and the next steps. Do not mark a failed try as done.
Build a provider-neutral route card
Keep one controlled route card. Name the legal maker, main-site result, and main CSIRT. List the States where the product was offered. Add the main and backup filing staff, in-house approver, and proof owner.
Link to the current EU site guide. Do not copy each screen into the fixed rule.
Date each set of work steps. Account rules, screens, and checks are run by the site and may change. Check the EU service before use. A guide from another firm may help form questions. It is not proof of how the site works now.
Distinguish an attempt from a submission
Set the proof needed before a stage can be marked filed. Keep the approved pack, exact data sent, end time, filing person, result, and receipt together. A saved draft or stopped try is still open work.
If the normal route is down, save proof of the fault. Follow the firm’s tested backup and alert steps. Do not make up a new reader. An email may not replace the legal site route.
Keep internal and external routing distinct
The site handles the outside route after filing. The in-house route must bring security, response, legal, and leaders to one proof record before the due time. Plan and test both routes. Name the owner of each handoff.
Test the in-house chain without a real report. The filing person should find the route card, approver, and allowed content. They should show where proof of completion will be kept. Stop the drill before any outside act.
The stable rule is one online entry and one legal route after filing. Site steps can change, so keep them in dated work notes. Do not present them as fixed law.
Continue this workflow with the coordinating-CSIRT analysis and the single-submission evidence model.