ActLume

ActLume blog

Privacy & security operator articles

CRA Article 14 guidance written for the privacy & security operator workflow role.

Privacy & security operator articles

6 available

  1. An orange source tile sends separate lines to five green destination tiles. Where does a CRA Article 14 notification go after a manufacturer submits it?

    Where a CRA report goes after submission

    The coordinating CSIRT ordinarily shares a CRA notification with relevant CSIRTs where the affected product was made available.

    3 min read
  2. An orange control gate holds a green signal inside a protected circular route. When can onward dissemination of a CRA Article 14 notification be delayed?

    CRA delayed dissemination is an exceptional route

    A coordinating CSIRT may delay onward dissemination only under the CRA's exceptional, justified cybersecurity conditions and for a strictly necessary period.

    3 min read
  3. Three selected green user nodes receive an orange signal inside a larger circular audience. When and to whom must a manufacturer send a CRA user notification?

    When the CRA requires an impacted-user notice

    After awareness of an actively exploited vulnerability or severe product-security incident, the manufacturer must inform impacted users and sometimes all users.

    3 min read
  4. Three large green action blocks sit beneath an orange notice marker in a square layout. What content should a manufacturer include in a CRA user notice?

    What a useful CRA user notice needs to say

    A CRA user notice should identify the affected product and give deployable mitigation or corrective steps where those measures are necessary.

    3 min read
  5. An orange sensitive field sits among separately classified green report strips. How should a manufacturer classify sensitive information in a CRA notification?

    Classify CRA report sensitivity before submission

    CRA 72-hour notifications indicate, where applicable, how sensitive the manufacturer considers the reported information to be.

    3 min read
  6. An orange incident marker sits inside two offset green assessment frames. How should a manufacturer assess one event that may be both a CRA product incident and a GDPR personal data breach?

    Triage a product incident under the CRA and GDPR

    A security event may require both a CRA product-security assessment and a GDPR personal-data-breach assessment because the regimes ask different questions.

    4 min read