What information does the 24-hour stage actually require?

Event type, awareness time, the Member States where the product is available, an initial view of suspected unlawful or malicious acts for severe incidents, plus platform access and an approved sender. Nothing more.

What should we do when an answer is unknown?

Record it as Unknown and assign an owner and a date. A named gap is useful evidence of preparation; a guessed fact in a reporting file is a liability.

Who should own each reporting stage?

Split ownership by data, not by department: awareness and event type, product and version facts, impact and mitigation, and legal or communications approval. Every owner needs a deputy with the same access.

Can we use this checklist during a real incident?

Treat it as preparation material. It helps you find missing owners and data before an event; it does not decide whether a real event is reportable and it is not a submission channel.

Reviewed 17 August 2026

CRA Article 14 reporting checklist for a tabletop exercise

Use this checklist for preparation, not as a substitute for the legal text or the Single Reporting Platform.

Last updated 17 August 2026 · Written and reviewed by Jonatan Tensetti · Tensetti Tools

Stage	Information to prepare
Scope and clock	Organisation role; product with digital elements; EU availability; awareness time; event type; main establishment; responsible owner and deputy.
24-hour preparation	Event type; awareness time; Member States where the product is available; for severe incidents, an initial view of suspected unlawful or malicious acts; platform access; approval and routing.
72-hour preparation	Product identification; affected versions; nature of vulnerability/exploitation or incident; initial severity and impact; measures taken/planned; user mitigation; sensitivity and handling; sources and approvers.
Final preparation	Corrective/security update for a vulnerability, or threat/root cause and complete mitigation for an incident; severity/impact; release and communication evidence; final owner.
Governance	RACI; safe evidence channel; correction process; supplier contacts; communications; after-action log.

Unknown is a valid tabletop answer. It should become an assigned action, not a guessed fact. Never paste live exploit data into a generic checklist.

Reviewed 17 August 2026 · assessment version 1.0.0

Turn the checklist into an explainable gap report

Frequently asked questions

What information does the 24-hour stage actually require?: Event type, awareness time, the Member States where the product is available, an initial view of suspected unlawful or malicious acts for severe incidents, plus platform access and an approved sender. Nothing more.
What should we do when an answer is unknown?: Record it as Unknown and assign an owner and a date. A named gap is useful evidence of preparation; a guessed fact in a reporting file is a liability.
Who should own each reporting stage?: Split ownership by data, not by department: awareness and event type, product and version facts, impact and mitigation, and legal or communications approval. Every owner needs a deputy with the same access.
Can we use this checklist during a real incident?: Treat it as preparation material. It helps you find missing owners and data before an event; it does not decide whether a real event is reportable and it is not a submission channel.