Jedes Feld der ENISA Single Reporting Platform
Nach Artikel 14 des Cyber Resilience Act reichen Sie zu demselben Ereignis drei Meldungen ein, jede ausführlicher als die vorherige. Diese Seite listet jedes Feld auf, das die Plattform abfragt, seine Zeichengrenze und ob es in der jeweiligen Stufe verpflichtend oder optional ist.
Due 24 hours after you become aware. It is deliberately thin: what the product is, that you believe there is an actively exploited vulnerability or a severe incident, and whether you think other Member States are affected. Estimates are allowed as long as you mark them.
Geht an: das in Ihrem Mitgliedstaat als Koordinator benannte CSIRT und die ENISA.
Due 72 hours after the same moment of awareness. The platform's own counter shows a due time 48 hours after your early warning went in, which is earlier than the law if you filed promptly. It adds the general nature of the exploit or incident, what you have done, what users can take, and how sensitive the information is.
Geht an: dasselbe koordinierende CSIRT und die ENISA. Marktüberwachungsbehörden können informiert werden.
For a vulnerability, due 14 days after a corrective or mitigating measure becomes available. For a severe incident, due one month after the 72 hour notification. It is the full account: severity, impact, root cause, and the update you shipped.
Geht an: dasselbe koordinierende CSIRT und die ENISA.
So lesen Sie die Tabelle
Two of the columns tell you which track you are on. Vulnerability means an actively exploited vulnerability in your product (Art. 14(1)-(2)). Incident means a severe incident having an impact on the security of the product (Art. 14(3)-(4)). The three sub-columns under each are the three filings.
ENISA hat die Plattform am 11. September 2026 ohne drei Dinge eröffnet, die die Verordnung vorsieht: eine Melde-API, freiwillige Meldungen nach Artikel 15 und, im Schwachstellenformular, das Feld für den Zeitpunkt der Kenntniserlangung. Dieses Feld kam mit Glossar v1.6 am 21. Oktober 2026: Es ist auf der Frühwarnung beider Meldewege Pflicht und heißt 'Date and time when you become aware'. Die Kenntniserlangung startet Ihre 24-Stunden-Frist; tragen Sie den Zeitpunkt daher genau ein und führen Sie selbst Nachweis darüber, wie Sie ihn festgestellt haben. Der eigene 72-Stunden-Zähler der Plattform zeigt eine Fälligkeit 48 Stunden nach Einreichung der Frühwarnung, was in keiner Richtung die gesetzliche Frist ist.
Die Zeichengrenzen sind die der Plattform. Freitextfelder werden andernorts stillschweigend gekürzt — schreiben Sie bis zur Grenze und prüfen Sie die Zeichenzahl vor dem Einfügen.
Springen zu: Common fields · ExploitClock-only · Track-specific fields
Common fields 20 Felder
Shared by both tracks: glossary rows 1 to 18, 7a and the AR Note (40). Rows 1 to 14 are asked on the early warning only: the three filings are tabs on one notification, and each tab asks only its own rows.
| Feld | Schlüssel | Max. | Schwachstelle | Vorfall | ||||
|---|---|---|---|---|---|---|---|---|
| 24h | 72h | Abschluss | 24h | 72h | Abschluss | |||
|
Notification type
Vulnerability or Incident
Auswahl: Vulnerability · Incident
|
notification_type | — | R | — | — | R | — | — |
|
Title
Short, specific: product + vulnerability/incident. No confidential technical detail.
|
title | 255 | R | — | — | R | — | — |
|
Summary
What is affected, what is known now, what you are doing. Facts only; mark estimates. State when you became aware.
|
summary | 4000 | R | — | — | R | — | — |
|
Manufacturer name
System-generated from SRP registration — must match.
|
manufacturer_name | 255 | R | — | — | R | — | — |
|
Member States where product available (Concerned CSIRT)
Art. 14(2)(a)/(4)(a). Your coordinating CSIRT's state is auto-added; add all others you know of.
|
member_states_where_product_available | — | R | — | — | R | — | — |
| Product name | product_name | 255 | R | — | — | R | — | — |
|
Product version / version range
All affected versions or a range.
|
product_version | 255 | R | — | — | R | — | — |
|
Additional Information
About the manufacturer: anything the standard fields do not cover that helps your coordinating CSIRT identify you, for example the group you belong to. Facts only.
|
manufacturer_additional_information | 255 | O | — | — | O | — | — |
|
Product type
Default / Important / Critical (Annex III/IV)
Auswahl: Default · Important · Critical
|
product_type | — | O | — | — | O | — | — |
|
Product class
Class I / Class II (important products only)
Auswahl: Class I · Class II
|
product_class | — | O | — | — | O | — | — |
|
Product category
Annex III/IV category name, if applicable.
|
product_category | — | O | — | — | O | — | — |
|
End of support indicator
Is the product past its support period?
Auswahl: No · Yes
|
end_of_support | — | O | — | — | O | — | — |
|
Component name
Affected third-party or open-source component and version.
|
component_name | 255 | O | — | — | O | — | — |
|
Mitigating measure expected shortly
Is a corrective/mitigating measure expected in the near term?
Auswahl: No · Yes
|
mitigating_measure_expected_shortly | — | O | — | — | O | — | — |
|
User action able to reduce impact
Concrete steps users can take now.
|
user_action_to_reduce_impact | 4000 | O | — | — | O | — | — |
|
Considered sensitivity of information
Art. 14(2)(b)/(4)(b): your assessment of how sensitive the notified information is.
|
sensitivity_of_information | 255 | O | O | — | O | O | — |
|
Corrective or mitigating measures taken
What the manufacturer has done so far.
|
corrective_measures_taken | 2000 | O | O | R | O | O | R |
|
Corrective or mitigating measures that users can take
Updates, configuration changes, workarounds.
|
corrective_measures_users_can_take | 4000 | O | O | R | O | O | R |
|
Attack vector
E.g. network / adjacent / local / physical; protocol or interface. Not asked on the early warning.
|
attack_vector | 255 | — | O | — | — | O | — |
|
AR Note
Free-text note from the Assigned Representative for anything no structured field covers. Use a structured field whenever one fits.
|
ar_note | — | O | O | O | O | O | O |
ExploitClock-only 1 Felder
Not on the platform. Carried in every draft so you and your Assigned Representative know which filing you are looking at.
| Feld | Schlüssel | Max. | Schwachstelle | Vorfall | ||||
|---|---|---|---|---|---|---|---|---|
| 24h | 72h | Abschluss | 24h | 72h | Abschluss | |||
|
Notification level
24hrs, 72hrs or Final
Auswahl: 24hrs · 72hrs · Final
|
notification_level | — | n/a | n/a | n/a | n/a | n/a | n/a |
Track-specific fields 21 Felder
Asked on one track, or named differently on each. The vulnerability fields come first (glossary v19 to v30), the awareness instant sits where the glossary puts it, then the severe incident fields (i31 to i39). A dash means the platform does not ask for that field on that filing.
| Feld | Schlüssel | Max. | Schwachstelle | Vorfall | ||||
|---|---|---|---|---|---|---|---|---|
| 24h | 72h | Abschluss | 24h | 72h | Abschluss | |||
| CVE ID | cve_id | 255 | O | — | — | — | — | — |
|
EUVD ID
ENISA European Vulnerability Database id, if known.
|
euvd_id | 255 | O | — | — | — | — | — |
|
General information (vulnerability + exploitation method)
Art. 14(2)(b): general nature of the exploit and of the vulnerability. No unverified attribution.
|
general_information | 4000 | O | R | — | — | — | — |
|
Date when corrective or mitigating measure has been available (UTC)
Starts the 14-day final-report clock (Art. 14(2)(c)).
|
date_corrective_measure_available | — | O | O | R | — | — | — |
|
Details about the security update / corrective measure available
Art. 14(2)(c): what the update or measure is, which versions carry it, how users obtain it.
|
details_security_update | 2000 | O | O | R | — | — | — |
|
Description of the severity of the vulnerability
Rating (e.g. CVSS), classification (CWE), rationale.
|
full_description_severity | 4000 | O | O | R | — | — | — |
|
Description of the impact of the vulnerability
Systems, components, data and users affected.
|
full_description_impact | 4000 | O | O | R | — | — | — |
|
Date/time of awareness (UTC)
When you reached a reasonable degree of certainty (Commission guidance C(2026) 5252 §213). If estimated, say so in the summary. Asked on the early warning only; it starts your 24h and 72h clocks and the evidence trail records it.
|
awareness_datetime_utc | — | R | — | — | R | — | — |
|
Date and time when the Actively Exploited Vulnerability occurred (UTC time)
Known or estimated date and time since when the vulnerability exists. Asked on the early warning and carried to the 72-hour notification, where you can update it. If you estimate, say so.
|
vulnerability_occurred_datetime | — | O | C | — | — | — | — |
|
Malicious actor that has exploited / is exploiting the vulnerability
Art. 14(2)(c)(ii). Mark unconfirmed.
|
malicious_actor_information | 100 | O | O | RIA | — | — | — |
|
Particular Exceptional Circumstances (PEC)
Art. 16(2) third subpara. Only at 72h. Restricts dissemination; justify below.
Auswahl: No · Yes
|
pec_toggle | — | — | O | — | — | — | — |
|
PEC delay reason
Tick at least one ground (Art. 16(2) third subparagraph): exploited in no Member State other than your coordinating CSIRT's; further dissemination contrary to that Member State's essential interests; or an imminent high cybersecurity risk from further dissemination.
|
pec_delay_reason | — | — | O | — | — | — | — |
|
Please provide further information
Shown once PEC is on: the facts that support your PEC request, for the coordinating CSIRT's decision. Free text.
|
additional_information_for_cdac | 800 | — | O | — | — | — | — |
|
Incident is suspected of unlawful or malicious acts
Art. 14(4)(a).
Auswahl: Unknown · Yes · No
|
incident_suspected_malicious | — | — | — | — | R | C | — |
|
General information about the nature of the incident
Art. 14(4)(b): what occurred, affected functions, known scope.
|
general_information_nature_of_incident | 4000 | — | — | — | O | R | — |
|
Applied and ongoing mitigation measures
With dates.
|
applied_or_ongoing_mitigation_measures | 4000 | — | — | — | O | O | R |
|
Detailed description of the severity of the incident
Sequence of events, affected products, scope, evidence, root cause, recovery.
|
detailed_description_severity | 4000 | — | — | — | O | O | R |
|
Detailed description of the impact of the incident
Operations, users, data.
|
detailed_description_impact | 4000 | — | — | — | O | O | R |
|
Type of threat or root cause that is likely to have triggered the incident
Classification + short explanation; mark preliminary if incomplete.
|
type_of_threat_or_root_cause | 255 | — | — | — | O | O | R |
|
Date and time when the incident occurred (UTC time)
Known or estimated start of the incident. Asked on the early warning and the 72-hour notification.
|
incident_occurred_datetime | — | — | — | — | O | O | — |
|
Initial assessment of the incident
Preliminary severity, scope, likely impact. Separate confirmed facts from what is under investigation.
|
initial_assessment | 4000 | — | — | — | O | R | — |
Was die Feldliste Ihnen nicht sagt
The platform has no API at launch, so a person types or pastes every one of these fields. Access is through EU Login with multi-factor authentication, and the people who may file are named Assigned Representatives, so getting an account ready is work you do before the clock starts, not after.
The 72 hour counter shown inside the platform displays a due time 48 hours after your early-warning submission (ENISA FAQ Q26). The legal deadline runs 72 hours from the moment you became aware. File the early warning promptly and the portal flags you as overdue a day early; file it late and the portal is generous while the law is not. ENISA says the counters are for visibility and will be re-based on the awareness field in a later release; the field itself arrived on 21 October 2026 (glossary v1.6), and FAQ Q26 has not yet said the counter uses it.
Two dates carry the whole timeline: the date and time of awareness, and the date a corrective or mitigating measure became available. The second one starts the 14 day final report clock for a vulnerability.
ExploitClock füllt diese Felder aus Ihren Produktdaten vor und bewahrt eine Kopie dessen auf, was Sie eingereicht haben
Register a product, upload its SBOM, and every draft arrives with the manufacturer identity, product name and versions, Member States, component, CVE and dates already in place, validated against the limits above. What you submit is recorded in a hash-chained evidence trail with the reference the platform gave you.
Quelle: das ENISA-Glossar zur CRA Single Reporting Platform v1.6 (21 October 2026), Zeile für Zeile in unserem Entwurfsschema gespiegelt. Datierte regulatorische Änderungen finden Sie auf /regulatory. Dies ist eine Referenz, keine Rechtsberatung.