Methodology
Deterministic rules, versioned question bank, explainable findings.
The question bank maps the Article 14 information flow into five sections: detection and clock, 24-hour early warning, 72-hour notification, final report, and operations and governance. Questions are structured; free text about vulnerabilities or incidents is never collected.
Scoring
Section weights are fixed: clock 20, 24-hour readiness 25, 72-hour readiness 25, final report 15 and governance 15. “Yes / evidenced” scores full points, “partly / draft” half, and “no” or “unknown” zero. The percentage is labelled exercise readiness. It is never a CRA compliance statement.
Critical rules
| Rule | Trigger | Finding |
|---|---|---|
| CRA_SCOPE_UNKNOWN | Role or EU availability unknown | Resolve legal scope before relying on the exercise |
| CRA_NO_CLOCK_OWNER | No awareness rule or clock owner | 24-hour clock cannot be governed |
| CRA_NO_PLATFORM_ACCESS | No tested access or named owner | Submission access may become a deadline blocker |
| CRA_NO_MEMBER_STATE_MAP | Cannot identify distribution countries | Early-warning information may be incomplete |
| CRA_NO_72H_PRODUCT_DATA | Identifier/version owner absent | 72-hour notification preparation is blocked |
| CRA_LIVE_DATA_RISK | Sensitive detail entry attempted | Stop entry; move real handling to an approved secure process |
| CRA_ACTIVE_EVENT | Event reported as real or active | End drill and show emergency escalation notice; store no details |
A critical finding stays visible regardless of the total score, and no reassuring label is shown when scope is unresolved. Identical answers under assessment version 1.0.0 always produce identical findings.