ActLume

ActLume blog

Incident manager articles

CRA Article 14 guidance written for the incident manager workflow role.

Incident manager articles

11 available

  1. A shared two-stage reporting path branches to separate incident-and-clock and document-and-clock outcomes. What must a manufacturer report under CRA Article 14, and when is each stage due?

    CRA Article 14 reporting stages and deadlines

    Both Article 14 tracks start with 24-hour and 72-hour stages, but their final-report clocks start from different events.

    8 min read
  2. A square evidence ring holds one orange signal beside two fixed checkpoints. When does the CRA Article 14 reporting clock start for a manufacturer?

    When does the CRA Article 14 clock start?

    The CRA Article 14 clock starts when an initial assessment gives the manufacturer reasonable certainty that an actively exploited vulnerability or severe incident meets the reporting trigger.

    5 min read
  3. Two distinct orange impact forms press against opposite sides of a green product core. How should a manufacturer test whether an incident is severe under CRA Article 14?

    The CRA severe product-security incident test

    Article 14 treats an incident as severe when it meets either of two product-security impact tests concerning protected data, functions, or malicious code.

    3 min read
  4. Fourteen green segments close around a solid orange corrective block in a square composition. What starts the CRA deadline for an actively exploited vulnerability final report?

    When is the CRA vulnerability final report due?

    The final report for an actively exploited vulnerability is due no later than 14 days after a corrective or mitigating measure becomes available.

    3 min read
  5. Two independent vertical lanes cross one shared orange intake line and finish at different points. Why should a manufacturer assess the two CRA Article 14 reporting tracks separately?

    The CRA has two Article 14 reporting tracks

    Article 14 separately covers actively exploited vulnerabilities and severe incidents affecting product security, with distinct final-report rules.

    3 min read
  6. A square dark frame holds a compact awareness record with a clock face, evidence rows, and an orange seal. How should a manufacturer preserve and reconcile the timestamps behind a CRA awareness record?

    Record the CRA awareness timestamp

    A CRA awareness record needs more than one timestamp. Preserve raw source and receipt times, record clock quality, and explain how the chosen instant was normalised to UTC.

    6 min read
  7. A small orange component is traced through three nested green product boundaries. When must a final-product manufacturer report an actively exploited vulnerability in a third-party component?

    When a component triggers CRA reporting

    A supplier's exploited flaw does not answer the final-product question; the manufacturer must establish whether its own product contains and is affected by it.

    3 min read
  8. An orange component connects to selected cells in a large green version matrix. How should a manufacturer map a vulnerable component to affected product versions for CRA reporting?

    Map vulnerable components to CRA product versions

    CRA reporting needs product-specific information, so component evidence must resolve to shipped product versions rather than stop at a dependency name.

    3 min read
  9. One orange product square is isolated from a larger field of green incident tiles. How should a manufacturer decide whether an enterprise security incident is also a CRA severe incident affecting a product?

    Separate product security and enterprise incidents

    CRA severe-incident reporting concerns an incident that affects or can affect a product's ability to protect specified data or functions, or enables malicious code.

    3 min read
  10. An orange event tile feeds two separated green decision rings. How should an organisation assess the same security event under both the CRA and NIS2?

    Triage one event under both the CRA and NIS2

    The same security event can require separate assessment under the CRA's product-manufacturer test and NIS2 rules applying to an affected entity.

    3 min read
  11. Several aged green product tiles align with one orange triage marker. How should a manufacturer prepare older products for CRA Article 14 reporting?

    Bring legacy products into CRA reporting triage

    CRA Article 14 reporting applies to in-scope products made available before 11 December 2027, not only to products launched after the main application date.

    3 min read