Riferimento gratuito · senza account

Ogni campo della ENISA Single Reporting Platform

Ai sensi dell'articolo 14 del Cyber Resilience Act si trasmettono tre notifiche sullo stesso evento, ciascuna più dettagliata della precedente. Questa pagina elenca ogni campo richiesto dalla piattaforma, il suo limite di caratteri e se sia obbligatorio o facoltativo in ciascuna fase.

24 orePreallarme

Due 24 hours after you become aware. It is deliberately thin: what the product is, that you believe there is an actively exploited vulnerability or a severe incident, and whether you think other Member States are affected. Estimates are allowed as long as you mark them.

Destinatari: il CSIRT designato come coordinatore nel Suo Stato membro ed ENISA.

72 oreNotifica delle vulnerabilità / notifica dell'incidente

Due 72 hours after the same moment of awareness. The platform's own counter shows a due time 48 hours after your early warning went in, which is earlier than the law if you filed promptly. It adds the general nature of the exploit or incident, what you have done, what users can take, and how sensitive the information is.

Destinatari: lo stesso CSIRT coordinatore ed ENISA. Le autorità di vigilanza del mercato possono essere informate.

FinaleRelazione finale

For a vulnerability, due 14 days after a corrective or mitigating measure becomes available. For a severe incident, due one month after the 72 hour notification. It is the full account: severity, impact, root cause, and the update you shipped.

Destinatari: lo stesso CSIRT coordinatore ed ENISA.

Come leggere la tabella

Two of the columns tell you which track you are on. Vulnerability means an actively exploited vulnerability in your product (Art. 14(1)-(2)). Incident means a severe incident having an impact on the security of the product (Art. 14(3)-(4)). The three sub-columns under each are the three filings.

R Obbligatorio RIA Obbligatorio se l'informazione è disponibile O Facoltativo C Ripreso dalla Sua notifica precedente, aggiorni se è cambiato — Non richiesto in quella trasmissione n/a Previsto dal regolamento, ma sulla piattaforma non c'è ancora un campo

ENISA ha aperto la piattaforma l'11 settembre 2026 senza tre cose che il regolamento prevede: un'API per le segnalazioni, la segnalazione volontaria ai sensi dell'articolo 15 e, nel modulo sulle vulnerabilità, il campo che registra quando si è venuti a conoscenza. Quel campo è arrivato con il glossario v1.6 il 21 ottobre 2026: è obbligatorio nel preallarme di entrambi i percorsi, con l'etichetta 'Date and time when you become aware'. È la conoscenza a far partire il Suo termine di 24 ore: la inserisca con precisione e conservi Lei stesso la registrazione di come l'ha accertata. Il contatore delle 72 ore della piattaforma indica una scadenza 48 ore dopo la trasmissione del preallarme, che non è il termine di legge né in un senso né nell'altro.

I limiti di caratteri sono quelli della piattaforma. Altrove i campi di testo libero vengono troncati senza avviso: scriva entro il limite e controlli il conteggio prima di incollare.

Vai a: Common fields · ExploitClock-only · Track-specific fields

Common fields 20 campi

Shared by both tracks: glossary rows 1 to 18, 7a and the AR Note (40). Rows 1 to 14 are asked on the early warning only: the three filings are tabs on one notification, and each tab asks only its own rows.

Campo	Chiave	Max	Vulnerabilità			Incidente
Campo	Chiave	Max	24h	72h	Finale	24h	72h	Finale
Notification type Vulnerability or Incident Opzioni: Vulnerability · Incident	notification_type	—	R	—	—	R	—	—
Title Short, specific: product + vulnerability/incident. No confidential technical detail.	title	255	R	—	—	R	—	—
Summary What is affected, what is known now, what you are doing. Facts only; mark estimates. State when you became aware.	summary	4000	R	—	—	R	—	—
Manufacturer name System-generated from SRP registration — must match.	manufacturer_name	255	R	—	—	R	—	—
Member States where product available (Concerned CSIRT) Art. 14(2)(a)/(4)(a). Your coordinating CSIRT's state is auto-added; add all others you know of.	member_states_where_product_available	—	R	—	—	R	—	—
Product name	product_name	255	R	—	—	R	—	—
Product version / version range All affected versions or a range.	product_version	255	R	—	—	R	—	—
Additional Information About the manufacturer: anything the standard fields do not cover that helps your coordinating CSIRT identify you, for example the group you belong to. Facts only.	manufacturer_additional_information	255	O	—	—	O	—	—
Product type Default / Important / Critical (Annex III/IV) Opzioni: Default · Important · Critical	product_type	—	O	—	—	O	—	—
Product class Class I / Class II (important products only) Opzioni: Class I · Class II	product_class	—	O	—	—	O	—	—
Product category Annex III/IV category name, if applicable.	product_category	—	O	—	—	O	—	—
End of support indicator Is the product past its support period? Opzioni: No · Yes	end_of_support	—	O	—	—	O	—	—
Component name Affected third-party or open-source component and version.	component_name	255	O	—	—	O	—	—
Mitigating measure expected shortly Is a corrective/mitigating measure expected in the near term? Opzioni: No · Yes	mitigating_measure_expected_shortly	—	O	—	—	O	—	—
User action able to reduce impact Concrete steps users can take now.	user_action_to_reduce_impact	4000	O	—	—	O	—	—
Considered sensitivity of information Art. 14(2)(b)/(4)(b): your assessment of how sensitive the notified information is.	sensitivity_of_information	255	O	O	—	O	O	—
Corrective or mitigating measures taken What the manufacturer has done so far.	corrective_measures_taken	2000	O	O	R	O	O	R
Corrective or mitigating measures that users can take Updates, configuration changes, workarounds.	corrective_measures_users_can_take	4000	O	O	R	O	O	R
Attack vector E.g. network / adjacent / local / physical; protocol or interface. Not asked on the early warning.	attack_vector	255	—	O	—	—	O	—
AR Note Free-text note from the Assigned Representative for anything no structured field covers. Use a structured field whenever one fits.	ar_note	—	O	O	O	O	O	O

ExploitClock-only 1 campi

Not on the platform. Carried in every draft so you and your Assigned Representative know which filing you are looking at.

Campo	Chiave	Max	Vulnerabilità			Incidente
Campo	Chiave	Max	24h	72h	Finale	24h	72h	Finale
Notification level 24hrs, 72hrs or Final Opzioni: 24hrs · 72hrs · Final	notification_level	—	n/a	n/a	n/a	n/a	n/a	n/a

Track-specific fields 21 campi

Asked on one track, or named differently on each. The vulnerability fields come first (glossary v19 to v30), the awareness instant sits where the glossary puts it, then the severe incident fields (i31 to i39). A dash means the platform does not ask for that field on that filing.

Campo	Chiave	Max	Vulnerabilità			Incidente
Campo	Chiave	Max	24h	72h	Finale	24h	72h	Finale
CVE ID	cve_id	255	O	—	—	—	—	—
EUVD ID ENISA European Vulnerability Database id, if known.	euvd_id	255	O	—	—	—	—	—
General information (vulnerability + exploitation method) Art. 14(2)(b): general nature of the exploit and of the vulnerability. No unverified attribution.	general_information	4000	O	R	—	—	—	—
Date when corrective or mitigating measure has been available (UTC) Starts the 14-day final-report clock (Art. 14(2)(c)).	date_corrective_measure_available	—	O	O	R	—	—	—
Details about the security update / corrective measure available Art. 14(2)(c): what the update or measure is, which versions carry it, how users obtain it.	details_security_update	2000	O	O	R	—	—	—
Description of the severity of the vulnerability Rating (e.g. CVSS), classification (CWE), rationale.	full_description_severity	4000	O	O	R	—	—	—
Description of the impact of the vulnerability Systems, components, data and users affected.	full_description_impact	4000	O	O	R	—	—	—
Date/time of awareness (UTC) When you reached a reasonable degree of certainty (Commission guidance C(2026) 5252 §213). If estimated, say so in the summary. Asked on the early warning only; it starts your 24h and 72h clocks and the evidence trail records it.	awareness_datetime_utc	—	R	—	—	R	—	—
Date and time when the Actively Exploited Vulnerability occurred (UTC time) Known or estimated date and time since when the vulnerability exists. Asked on the early warning and carried to the 72-hour notification, where you can update it. If you estimate, say so.	vulnerability_occurred_datetime	—	O	C	—	—	—	—
Malicious actor that has exploited / is exploiting the vulnerability Art. 14(2)(c)(ii). Mark unconfirmed.	malicious_actor_information	100	O	O	RIA	—	—	—
Particular Exceptional Circumstances (PEC) Art. 16(2) third subpara. Only at 72h. Restricts dissemination; justify below. Opzioni: No · Yes	pec_toggle	—	—	O	—	—	—	—
PEC delay reason Tick at least one ground (Art. 16(2) third subparagraph): exploited in no Member State other than your coordinating CSIRT's; further dissemination contrary to that Member State's essential interests; or an imminent high cybersecurity risk from further dissemination.	pec_delay_reason	—	—	O	—	—	—	—
Please provide further information Shown once PEC is on: the facts that support your PEC request, for the coordinating CSIRT's decision. Free text.	additional_information_for_cdac	800	—	O	—	—	—	—
Incident is suspected of unlawful or malicious acts Art. 14(4)(a). Opzioni: Unknown · Yes · No	incident_suspected_malicious	—	—	—	—	R	C	—
General information about the nature of the incident Art. 14(4)(b): what occurred, affected functions, known scope.	general_information_nature_of_incident	4000	—	—	—	O	R	—
Applied and ongoing mitigation measures With dates.	applied_or_ongoing_mitigation_measures	4000	—	—	—	O	O	R
Detailed description of the severity of the incident Sequence of events, affected products, scope, evidence, root cause, recovery.	detailed_description_severity	4000	—	—	—	O	O	R
Detailed description of the impact of the incident Operations, users, data.	detailed_description_impact	4000	—	—	—	O	O	R
Type of threat or root cause that is likely to have triggered the incident Classification + short explanation; mark preliminary if incomplete.	type_of_threat_or_root_cause	255	—	—	—	O	O	R
Date and time when the incident occurred (UTC time) Known or estimated start of the incident. Asked on the early warning and the 72-hour notification.	incident_occurred_datetime	—	—	—	—	O	O	—
Initial assessment of the incident Preliminary severity, scope, likely impact. Separate confirmed facts from what is under investigation.	initial_assessment	4000	—	—	—	O	R	—

Ciò che l'elenco dei campi non Le dice

The platform has no API at launch, so a person types or pastes every one of these fields. Access is through EU Login with multi-factor authentication, and the people who may file are named Assigned Representatives, so getting an account ready is work you do before the clock starts, not after.

The 72 hour counter shown inside the platform displays a due time 48 hours after your early-warning submission (ENISA FAQ Q26). The legal deadline runs 72 hours from the moment you became aware. File the early warning promptly and the portal flags you as overdue a day early; file it late and the portal is generous while the law is not. ENISA says the counters are for visibility and will be re-based on the awareness field in a later release; the field itself arrived on 21 October 2026 (glossary v1.6), and FAQ Q26 has not yet said the counter uses it.

Two dates carry the whole timeline: the date and time of awareness, and the date a corrective or mitigating measure became available. The second one starts the 14 day final report clock for a vulnerability.

ExploitClock precompila questi campi con i dati dei Suoi prodotti e conserva una copia di ciò che ha trasmesso

Register a product, upload its SBOM, and every draft arrives with the manufacturer identity, product name and versions, Member States, component, CVE and dates already in place, validated against the limits above. What you submit is recorded in a hash-chained evidence trail with the reference the platform gave you.

Vedi i prezzi Generatore gratuito di security.txt e politica di divulgazione Come funziona la trasmissione

Fonte: il glossario della ENISA CRA Single Reporting Platform v1.6 (21 October 2026), rispecchiata riga per riga nel nostro schema delle bozze. Le modifiche normative con data si trovano su /regulatory. Questo è un riferimento, non consulenza legale.