Cyber Resilience Act reporting readiness
Can your team build the CRA report before the clock runs out?
Rehearse 24 hours. Build 72 hours. Find the gaps before a real event.
The CRA's reporting duties apply from 11 September 2026. Run a fictional scenario, see which information and owners are missing, and turn the result into a practical rehearsal plan. No live incident data. No compliance verdict.
Primary EU and ENISA sources · Versioned rules · Your result is not an official notification
CRA reporting starts 11 September 2026. General CRA application follows on 11 December 2027. Verify current implementation details in the linked official sources.
- AwarenessT+0
- Early warningT+24h
- NotificationT+72h
- Final reportApplicable clock
A 24-hour deadline is an information problem before it is a writing problem
The first warning needs an owner, an awareness time, an event type and market-routing information. The 72-hour notification adds product, impact, measures and user mitigation. If those facts live with different teams, the clock exposes the gaps.
CRA 24/72 Drill gives the exercise a shared structure. It does not decide whether a real event is reportable and it never asks you to paste exploit details.
What the free drill checks
- Who starts and owns the awareness clock.
- Whether platform access and routing are prepared.
- Whether the 24-hour minimum can be assembled.
- Whether product and impact data can support 72 hours.
- Whether the final report has owners and evidence.
- Where the workflow needs professional or authority input.
How it works
- 01
Choose a fictional scenario and organisation role.
- 02
Answer structured readiness questions — “unknown” is allowed.
- 03
Receive an explainable result and top five blockers.
- 04
Buy the full pack only if you need the field workbook, RACI and export.
Take a usable rehearsal pack into the incident room
The Incident Drill Pack converts the same answers into a 24-hour/72-hour/final field matrix, named-owner gaps, a sixty-minute tabletop agenda, a RACI, and a 7/30/90-day action plan. Export as PDF, CSV and Markdown.
- One fictional scenario
- Timer view and top five gaps
- No saved sensitive detail
- Full findings and field workbook
- 24h / 72h / final matrices, RACI
- Action plan, PDF/CSV/Markdown export
- Six saved fictional scenarios/year
- Reusable team profile and history
- Five users
Checkout is running in test mode while the tax treatment is being reviewed. No live payments are taken.
Who it is for
Manufacturers of products with digital elements, product-security and PSIRT teams, compliance/legal teams, open-source stewards, and advisers facilitating an internal tabletop.
Who should not use it
Do not use this service to handle an active incident, determine legal reportability, store vulnerability evidence or submit to ENISA. Importers and distributors can use the scope prompts, but the Article 14 reporting flow is centred on manufacturers and relevant open-source stewards.
Preparation reading
| Page | What it covers |
|---|---|
| CRA reporting deadlines | Source-linked timeline for the 24h, 72h and final clocks. |
| Article 14 checklist | Field matrix for scope, 24h, 72h, final and governance. |
| Incident reporting template | What to prepare, with a fictional worked example. |
| Single Reporting Platform preparation | Access, routing and deputies checklist. |
Questions
- Is this an official CRA reporting channel?
- No. It is a tabletop readiness and documentation tool. Official reporting uses the EU Single Reporting Platform and the relevant authority process.
- Can I use a real incident?
- No. Use fictional or sanitised facts only. Do not enter active vulnerability details, credentials, personal data or confidential evidence.
- Does a good score mean we comply with the CRA?
- No. The score describes how complete your rehearsal workflow appears from your answers. It is not a legal opinion, audit or compliance determination.
- Why 24 hours and 72 hours?
- Article 14 establishes an early-warning step within 24 hours of awareness and a more complete notification within 72 hours, followed by a final report on the applicable timetable. See the official sources and current status note.
- What if we do not know whether the event is reportable?
- Choose “unknown”. The result will flag scope and escalation rather than force a yes/no answer. Resolve the real decision with your authorised security/legal team and, where appropriate, the relevant authority.
- Is the drill relevant before December 2027?
- Yes. The reporting obligations start earlier, on 11 September 2026, and the Commission states that they apply to products already made available on the Union market.
- Can a consultant use this with clients?
- The standard licence is for internal business use. A facilitator can use a purchased report for one named client scenario. Repeated resale or white-labelling requires a separate licence, which we do not currently offer.
- Where do the questions come from?
- The product maps the Article 14 information flow and official CRA/ENISA implementation pages into an independent rehearsal method. The source register shows direct links and review dates.
Sources reviewed 17 August 2026 · source register