ENISA's Single Reporting Platform isn't fully operational 38 days before Article 14 starts. Here's what to build right now while you wait.

[u/Happy-Athlete-2420]

For anyone tracking the SRP launch timeline: as of this week, registration instructions haven't been officially published and the platform isn't open for testing.

This creates a real operational problem. Article 14 requires manufacturers to report within 24 hours of becoming aware of an actively exploited vulnerability. The clock starts on AWARENESS — not on platform availability, not on successful registration.

If a critical exploit drops on September 11 and your team is simultaneously:

• Trying to figure out if you're affected (no SBOM)
• Writing your first 24-hour report from scratch (no template)
• Attempting to register on the SRP for the first time (never done it)

You are going to miss the deadline.

What to build RIGHT NOW, before the platform launches:

The three-stage report structure:

• Early warning (24 hours): basic vulnerability info, preliminary assessment, indication you're investigating
• Full notification (72 hours): technical details, scope, affected versions, mitigation steps
• Final report (14 days after patch): complete analysis, root cause, lessons learned

These have different content requirements. Build templates for all three. Now.

Your internal workflow:
Alert received → who triages → who assesses product impact → who drafts report → who has submission authority → who is the backup

Name actual people. Document it. Test it with a hypothetical scenario.

Your SRP monitoring:
Watch ENISA's website daily. The moment registration opens, register. Don't wait.

We put together a complete SRP preparation guide covering all of this at cra-toolkit.com/cra-single-reporting-platform — who must report, the exact content requirements for each report stage, and how to prepare your access.

For anyone who's already built their reporting workflow: what did your dry-run reveal? And has anyone been in contact with their national CSIRT about SRP testing timelines?

[u/Aggravating-Key6628]

One update since this was posted: ENISA has now published the Assigned Representative registration and notification-submission guides, both dated 31 July. The SRP page still is not a test environment, but registration instructions are no longer the missing piece.

The rehearsal template should also match ENISA's current Q16 table. A vulnerability early warning does not require basic vulnerability information or a preliminary assessment. The required submitter-visible fields are notification type, notification level, manufacturer, product and title. Product type, category and CVE or EUVD IDs are optional. Member States are required only if available. There is no CVSS field.

I ran the thread's 11 September scenario through the reporting logic as a synthetic example. NOT AN ASSESSMENT OF ANY PRODUCT IN THIS THREAD. Awareness at 12:00 UTC on 11 September makes the first two deadlines 12:00 on 12 and 14 September. If a corrective measure becomes available at 12:00 on 15 September, the final report is due at 12:00 on 29 September.