FREE · BROWSER-ONLY · ENISA Q16 FIELDS

Build the right CRA brief
for the stage you are in.

Filter the published Single Reporting Platform field map by occurrence and reporting stage—before a real 24-hour clock starts.

Build the local brief Audit the full field map

Do not enter occurrence data. This page has no incident fields, form submission, account, analytics, API, or server storage.

41 DAYS TO FIRST DUTY2 OCCURRENCE ROUTES3 REPORTING STAGES0 CASE DATA COLLECTED

PRIVATE REHEARSAL · CHECKED 01 AUG 2026

Choose the route.
Read the handoff.

Codes and field names follow ENISA's 17 July Q16 table. Preparation prompts are independent workflow suggestions.

24-hour early warning

Severe security incident

6Obligatory

1If available

0Copied

1Automated

9Optional

Common · 1 · Obligatory

Notification type (vulnerability / incident)

Agree the occurrence-routing owner and preserve the decision basis.

Common · 2 · Obligatory

Notification level (24h / 72h / final)

Map each stage to an approver and a submission handoff.

Common · 7 · Obligatory

Manufacturer or open-source software steward

Keep the legal name and role source available to the reporting team.

Common · 8 · Obligatory

Product

Maintain an unambiguous product and version identifier.

Common · 11 · Obligatory if available

Member States where product is available

Keep a current market list with a named source of truth.

Common · 12 · Obligatory

Title

Use a neutral internal naming convention that avoids unsupported conclusions.

Incident · i13 · Obligatory

Incident suspected to involve unlawful or malicious acts

Define the escalation path for a cautious, evidence-based first assessment.

Copied text contains only the published field names and preparation prompts shown here.

PUBLISHED CODES

Read the stage,
not just the row.

XObligatory

Required in the selected stage.

IObligatory if available

Required when the information is available.

CCopied or updated

Carried forward by default or updated.

AAutomated

Supplied by the platform and not visible.

OOptional

May be supplied at this stage.

SECURITY + LEGAL BOUNDARY

Prepare structure.
Keep the case elsewhere.

Does not decide CRA scope, reportability, awareness, exploitation, or severity
Does not collect, store, transmit, or submit occurrence information
Does not reproduce the live SRP interface or guarantee its launch implementation
Does not replace qualified counsel, an incident process, CSIRT guidance, ENISA, or the live platform

PUBLIC EVIDENCE · VERIFIED 01 AUG 2026

The live source controls.

ENISA · updated 17 JULSRP FAQ and Q16 field table ↗European Commission · updated JUN 2026CRA reporting obligations ↗

FROM BRIEF TO FULL DRILL

Add owners, evidence,
fictional cases, and print.

The $59 CRA Incident Reporting Drill Kit is an offline browser workspace with a deadline engine, owner and evidence fields, JSON portability, tests, and a print packet.