Référence gratuite · aucun compte nécessaire

Chaque champ de l'ENISA Single Reporting Platform

Au titre de l'article 14 du Cyber Resilience Act, vous déposez trois notifications sur le même événement, chacune plus détaillée que la précédente. Cette page liste chaque champ demandé par la plateforme, sa limite de caractères et son caractère obligatoire ou facultatif à chaque étape.

24 heuresAlerte précoce

Due 24 hours after you become aware. It is deliberately thin: what the product is, that you believe there is an actively exploited vulnerability or a severe incident, and whether you think other Member States are affected. Estimates are allowed as long as you mark them.

Destinataires : le CSIRT désigné comme coordinateur dans votre État membre, et l'ENISA.

72 heuresNotification de vulnérabilité / notification d'incident

Due 72 hours after the same moment of awareness. The platform's own counter shows a due time 48 hours after your early warning went in, which is earlier than the law if you filed promptly. It adds the general nature of the exploit or incident, what you have done, what users can take, and how sensitive the information is.

Destinataires : le même CSIRT désigné comme coordinateur et l'ENISA. Les autorités de surveillance du marché peuvent en être informées.

FinalRapport final

For a vulnerability, due 14 days after a corrective or mitigating measure becomes available. For a severe incident, due one month after the 72 hour notification. It is the full account: severity, impact, root cause, and the update you shipped.

Destinataires : le même CSIRT désigné comme coordinateur et l'ENISA.

Comment lire le tableau

Two of the columns tell you which track you are on. Vulnerability means an actively exploited vulnerability in your product (Art. 14(1)-(2)). Incident means a severe incident having an impact on the security of the product (Art. 14(3)-(4)). The three sub-columns under each are the three filings.

R Obligatoire RIA Obligatoire si l'information est disponible O Facultatif C Repris de votre notification précédente, à mettre à jour en cas de changement — Non demandé à cette étape n/a Prévu par le règlement, mais pas encore de champ sur la plateforme

L'ENISA a ouvert la plateforme le 11 septembre 2026 sans trois choses que le règlement prévoit : une API de signalement, le signalement volontaire au titre de l'article 15 et, dans le formulaire de vulnérabilité, le champ qui enregistre le moment où vous avez eu connaissance des faits. Ce champ est arrivé avec le glossaire v1.6 le 21 octobre 2026 : il est obligatoire dans l'alerte précoce des deux parcours, sous le libellé 'Date and time when you become aware'. C'est la prise de connaissance qui déclenche votre délai de 24 heures : saisissez-la avec précision et conservez vous-même la trace de la manière dont vous l'avez établie. Le compteur de 72 heures de la plateforme affiche une échéance 48 heures après l'envoi de votre alerte précoce, ce qui n'est le délai légal ni dans un sens ni dans l'autre.

Les limites de caractères sont celles de la plateforme. Ailleurs, les champs libres tronquent silencieusement : écrivez jusqu'à la limite et vérifiez le compte avant de coller.

Aller à : Common fields · ExploitClock-only · Track-specific fields

Common fields 20 champs

Shared by both tracks: glossary rows 1 to 18, 7a and the AR Note (40). Rows 1 to 14 are asked on the early warning only: the three filings are tabs on one notification, and each tab asks only its own rows.

Champ	Clé	Max	Vulnérabilité			Incident
Champ	Clé	Max	24h	72h	Final	24h	72h	Final
Notification type Vulnerability or Incident Choix : Vulnerability · Incident	notification_type	—	R	—	—	R	—	—
Title Short, specific: product + vulnerability/incident. No confidential technical detail.	title	255	R	—	—	R	—	—
Summary What is affected, what is known now, what you are doing. Facts only; mark estimates. State when you became aware.	summary	4000	R	—	—	R	—	—
Manufacturer name System-generated from SRP registration — must match.	manufacturer_name	255	R	—	—	R	—	—
Member States where product available (Concerned CSIRT) Art. 14(2)(a)/(4)(a). Your coordinating CSIRT's state is auto-added; add all others you know of.	member_states_where_product_available	—	R	—	—	R	—	—
Product name	product_name	255	R	—	—	R	—	—
Product version / version range All affected versions or a range.	product_version	255	R	—	—	R	—	—
Additional Information About the manufacturer: anything the standard fields do not cover that helps your coordinating CSIRT identify you, for example the group you belong to. Facts only.	manufacturer_additional_information	255	O	—	—	O	—	—
Product type Default / Important / Critical (Annex III/IV) Choix : Default · Important · Critical	product_type	—	O	—	—	O	—	—
Product class Class I / Class II (important products only) Choix : Class I · Class II	product_class	—	O	—	—	O	—	—
Product category Annex III/IV category name, if applicable.	product_category	—	O	—	—	O	—	—
End of support indicator Is the product past its support period? Choix : No · Yes	end_of_support	—	O	—	—	O	—	—
Component name Affected third-party or open-source component and version.	component_name	255	O	—	—	O	—	—
Mitigating measure expected shortly Is a corrective/mitigating measure expected in the near term? Choix : No · Yes	mitigating_measure_expected_shortly	—	O	—	—	O	—	—
User action able to reduce impact Concrete steps users can take now.	user_action_to_reduce_impact	4000	O	—	—	O	—	—
Considered sensitivity of information Art. 14(2)(b)/(4)(b): your assessment of how sensitive the notified information is.	sensitivity_of_information	255	O	O	—	O	O	—
Corrective or mitigating measures taken What the manufacturer has done so far.	corrective_measures_taken	2000	O	O	R	O	O	R
Corrective or mitigating measures that users can take Updates, configuration changes, workarounds.	corrective_measures_users_can_take	4000	O	O	R	O	O	R
Attack vector E.g. network / adjacent / local / physical; protocol or interface. Not asked on the early warning.	attack_vector	255	—	O	—	—	O	—
AR Note Free-text note from the Assigned Representative for anything no structured field covers. Use a structured field whenever one fits.	ar_note	—	O	O	O	O	O	O

ExploitClock-only 1 champs

Not on the platform. Carried in every draft so you and your Assigned Representative know which filing you are looking at.

Champ	Clé	Max	Vulnérabilité			Incident
Champ	Clé	Max	24h	72h	Final	24h	72h	Final
Notification level 24hrs, 72hrs or Final Choix : 24hrs · 72hrs · Final	notification_level	—	n/a	n/a	n/a	n/a	n/a	n/a

Track-specific fields 21 champs

Asked on one track, or named differently on each. The vulnerability fields come first (glossary v19 to v30), the awareness instant sits where the glossary puts it, then the severe incident fields (i31 to i39). A dash means the platform does not ask for that field on that filing.

Champ	Clé	Max	Vulnérabilité			Incident
Champ	Clé	Max	24h	72h	Final	24h	72h	Final
CVE ID	cve_id	255	O	—	—	—	—	—
EUVD ID ENISA European Vulnerability Database id, if known.	euvd_id	255	O	—	—	—	—	—
General information (vulnerability + exploitation method) Art. 14(2)(b): general nature of the exploit and of the vulnerability. No unverified attribution.	general_information	4000	O	R	—	—	—	—
Date when corrective or mitigating measure has been available (UTC) Starts the 14-day final-report clock (Art. 14(2)(c)).	date_corrective_measure_available	—	O	O	R	—	—	—
Details about the security update / corrective measure available Art. 14(2)(c): what the update or measure is, which versions carry it, how users obtain it.	details_security_update	2000	O	O	R	—	—	—
Description of the severity of the vulnerability Rating (e.g. CVSS), classification (CWE), rationale.	full_description_severity	4000	O	O	R	—	—	—
Description of the impact of the vulnerability Systems, components, data and users affected.	full_description_impact	4000	O	O	R	—	—	—
Date/time of awareness (UTC) When you reached a reasonable degree of certainty (Commission guidance C(2026) 5252 §213). If estimated, say so in the summary. Asked on the early warning only; it starts your 24h and 72h clocks and the evidence trail records it.	awareness_datetime_utc	—	R	—	—	R	—	—
Date and time when the Actively Exploited Vulnerability occurred (UTC time) Known or estimated date and time since when the vulnerability exists. Asked on the early warning and carried to the 72-hour notification, where you can update it. If you estimate, say so.	vulnerability_occurred_datetime	—	O	C	—	—	—	—
Malicious actor that has exploited / is exploiting the vulnerability Art. 14(2)(c)(ii). Mark unconfirmed.	malicious_actor_information	100	O	O	RIA	—	—	—
Particular Exceptional Circumstances (PEC) Art. 16(2) third subpara. Only at 72h. Restricts dissemination; justify below. Choix : No · Yes	pec_toggle	—	—	O	—	—	—	—
PEC delay reason Tick at least one ground (Art. 16(2) third subparagraph): exploited in no Member State other than your coordinating CSIRT's; further dissemination contrary to that Member State's essential interests; or an imminent high cybersecurity risk from further dissemination.	pec_delay_reason	—	—	O	—	—	—	—
Please provide further information Shown once PEC is on: the facts that support your PEC request, for the coordinating CSIRT's decision. Free text.	additional_information_for_cdac	800	—	O	—	—	—	—
Incident is suspected of unlawful or malicious acts Art. 14(4)(a). Choix : Unknown · Yes · No	incident_suspected_malicious	—	—	—	—	R	C	—
General information about the nature of the incident Art. 14(4)(b): what occurred, affected functions, known scope.	general_information_nature_of_incident	4000	—	—	—	O	R	—
Applied and ongoing mitigation measures With dates.	applied_or_ongoing_mitigation_measures	4000	—	—	—	O	O	R
Detailed description of the severity of the incident Sequence of events, affected products, scope, evidence, root cause, recovery.	detailed_description_severity	4000	—	—	—	O	O	R
Detailed description of the impact of the incident Operations, users, data.	detailed_description_impact	4000	—	—	—	O	O	R
Type of threat or root cause that is likely to have triggered the incident Classification + short explanation; mark preliminary if incomplete.	type_of_threat_or_root_cause	255	—	—	—	O	O	R
Date and time when the incident occurred (UTC time) Known or estimated start of the incident. Asked on the early warning and the 72-hour notification.	incident_occurred_datetime	—	—	—	—	O	O	—
Initial assessment of the incident Preliminary severity, scope, likely impact. Separate confirmed facts from what is under investigation.	initial_assessment	4000	—	—	—	O	R	—

Ce que la liste des champs ne vous dit pas

The platform has no API at launch, so a person types or pastes every one of these fields. Access is through EU Login with multi-factor authentication, and the people who may file are named Assigned Representatives, so getting an account ready is work you do before the clock starts, not after.

The 72 hour counter shown inside the platform displays a due time 48 hours after your early-warning submission (ENISA FAQ Q26). The legal deadline runs 72 hours from the moment you became aware. File the early warning promptly and the portal flags you as overdue a day early; file it late and the portal is generous while the law is not. ENISA says the counters are for visibility and will be re-based on the awareness field in a later release; the field itself arrived on 21 October 2026 (glossary v1.6), and FAQ Q26 has not yet said the counter uses it.

Two dates carry the whole timeline: the date and time of awareness, and the date a corrective or mitigating measure became available. The second one starts the 14 day final report clock for a vulnerability.

ExploitClock pré-remplit ces champs à partir des données de votre produit et conserve une copie de ce que vous avez déposé

Register a product, upload its SBOM, and every draft arrives with the manufacturer identity, product name and versions, Member States, component, CVE and dates already in place, validated against the limits above. What you submit is recorded in a hash-chained evidence trail with the reference the platform gave you.

Voir les tarifs Générateur gratuit de security.txt et de politique de divulgation Comment se passe le dépôt

Source : le glossaire de l'ENISA CRA Single Reporting Platform v1.6 (21 October 2026), reproduit ligne par ligne dans notre schéma de brouillon. Les évolutions réglementaires datées figurent sur /regulatory. Ceci est une référence, pas un conseil juridique.