Komplyo blog
Incidents and vulnerabilities
A single incident can fall under several notification deadlines: 72 hours under the GDPR, 24 hours for the NIS2 early warning, 24 hours under the CRA for a vulnerability under active exploitation. These articles set out the triggers, the recipients and the expected content of each notification, along with the coordinated vulnerability disclosure policy.
Your first notification on ENISA's Single Reporting Platform: a CRA walkthrough for SMEs
ENISA's Single Reporting Platform has been open since 11 September 2026. An operational guide for an SME: create the account, pick the right CSIRT, fill in the 24-hour early warning, understand what becoming aware sets running, and what the platform does and does not do today.
- CRA
- ENISA
- EU Regulation
- Incident response
- NIST CSF
CRA: the 24-hour and 72-hour notification obligation has applied since 11 September 2026
Article 14 of Regulation (EU) 2024/2847 has applied since 11 September 2026, fifteen months ahead of the rest of the CRA. Early warning within 24 hours, notification within 72 hours, final report within 14 days or one month, through ENISA's single reporting platform. What a manufacturer, including an SME software vendor, must have in place.
- CRA
- EU regulation
- Incident response
- NIST CSF
Coordinated vulnerability disclosure (CVD): the policy the CRA requires, in practice
Annex I, Part II of Regulation (EU) 2024/2847 requires manufacturers to have a coordinated vulnerability disclosure policy. What the policy must contain, the ISO/IEC 29147 and 30111 standards that structure it, the French framework (L. 2321-4 and L. 2321-4-1) and a proportionate implementation for an SME.
- CRA
- CVD
- Vulnerability management
- NIST CSF
Get the security policy template
An information security policy template in .docx format, structured around NIST CSF 2.0 and ISO 27001. Delivered by email, usable as a documentation baseline.