{"product_id":"cra-psirt-sarbarhetsrapportering-artikel14","title":"CRA PSIRT – Vulnerability Reception, 24\/72h Reporting and Chain of Custody | Word\/PDF\/Excel","description":"\u003cp\u003e\u003cstrong\u003eReceive, assess and document a concrete security vulnerability or incident in a digital product – from the initial report to the actual CRA notification and customer communication.\u003c\/strong\u003e This specialist package for manufacturers of products with digital elements focuses on CRA Article 14 and ENISA's Single Reporting Platform (SRP). It does not replace a broader CRA risk assessment, SBOM or actual regulatory reporting.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eQuick facts:\u003c\/strong\u003e 5 Swedish working documents, 1 Swedish user guide and 1 English User Guide, all in editable Word (DOCX) and searchable, printable PDF (not interactive forms), plus 1 Swedish Excel workbook with 9 tabs. Total \u003cstrong\u003e15 customer files\u003c\/strong\u003e: seven standalone documents in two formats plus one XLSX. Digital ZIP delivery upon future activation.\u003c\/p\u003e\n\u003csection aria-label=\"Package contents\" style=\"border:1px solid #b7c8dc;border-radius:10px;background:#f0f6fc;padding:18px;margin:22px 0\"\u003e\u003ch2\u003ePackage contents\u003c\/h2\u003e\n\n\u003cp\u003eFive standalone operational Word documents, one Swedish and one English guide, seven corresponding searchable PDF copies and one Excel workbook. Total 7 document types and 15 files. The working documents and Excel are in Swedish; only the English guide is in English.\u003c\/p\u003e\u003c\/section\u003e\n\u003csection aria-label=\"What the files contain\" style=\"border:1px solid #b7c8dc;border-radius:10px;background:#fff;padding:18px;margin:22px 0\"\u003e\u003ch2\u003eWhat the files contain\u003c\/h2\u003e\n\n\u003cp\u003ePSIRT responsibility and authority, vulnerability intake, evidence and source control, two different reporting triggers, awareness timing, reporting basis and actual SRP IDs\/receipts, security updates, customer communications and post-checks. Excel provides a traceable administrative overview – no automatic regulatory notification.\u003c\/p\u003e\u003c\/section\u003e\n\u003ch2\u003eWho should choose the template – and when?\u003c\/h2\u003e\u003cp\u003eFor product developers and manufacturers who sell software, connected equipment or other products with digital elements on the EU market and must handle an indication of active exploitation or a serious security incident. Two use cases: a reporter sends evidence of attacks against a specific firmware version; or a manufacturer becomes aware of an incident that seriously affects the product's security. If you are a regular reseller, IT service provider or only handle internal IT incidents, other documents and other rules may be appropriate. Legal manufacturer status and CRA applicability must first be checked.\u003c\/p\u003e\n\u003ch2\u003eFile by file\u003c\/h2\u003e\u003cdiv style=\"overflow-x:auto\"\u003e\u003ctable\u003e\n\n\u003cthead\u003e\u003ctr\u003e\n\n\u003cth\u003eDocument\u003c\/th\u003e\n\n\u003cth\u003ePractical purpose\u003c\/th\u003e\n\n\u003cth\u003eLanguage\u003c\/th\u003e\n\n\u003cth\u003eFormat\u003c\/th\u003e\n\n\n\u003c\/tr\u003e\u003c\/thead\u003e\n\n\u003ctbody\u003e\n\n\u003ctr\u003e\n\n\u003ctd\u003e1. PSIRT – responsibility and preparedness\u003c\/td\u003e\n\n\u003ctd\u003eRoles, authorized representative, CSIRT, escalation and backup procedure.\u003c\/td\u003e\n\n\u003ctd\u003eSwedish\u003c\/td\u003e\n\n\u003ctd\u003eDOCX + searchable PDF\u003c\/td\u003e\n\n\n\u003c\/tr\u003e\n\n\u003ctr\u003e\n\n\u003ctd\u003e2. Vulnerability report intake\u003c\/td\u003e\n\n\u003ctd\u003eSecure intake, product\/version linkage, source and evidence control.\u003c\/td\u003e\n\n\u003ctd\u003eSwedish\u003c\/td\u003e\n\n\u003ctd\u003eDOCX + searchable PDF\u003c\/td\u003e\n\n\n\u003c\/tr\u003e\n\n\u003ctr\u003e\n\n\u003ctd\u003e3. CRA reportability assessment\u003c\/td\u003e\n\n\u003ctd\u003eSeparate assessment of actively exploited vulnerability and serious incident.\u003c\/td\u003e\n\n\u003ctd\u003eSwedish\u003c\/td\u003e\n\n\u003ctd\u003eDOCX + searchable PDF\u003c\/td\u003e\n\n\n\u003c\/tr\u003e\n\n\u003ctr\u003e\n\n\u003ctd\u003e4. SRP reporting basis\u003c\/td\u003e\n\n\u003ctd\u003eBasis for 24h, 72h, AEV\/SI final report and actual SRP receipt.\u003c\/td\u003e\n\n\u003ctd\u003eSwedish\u003c\/td\u003e\n\n\u003ctd\u003eDOCX + searchable PDF\u003c\/td\u003e\n\n\n\u003c\/tr\u003e\n\n\u003ctr\u003e\n\n\u003ctd\u003e5. Coordinated remediation and customer communication\u003c\/td\u003e\n\n\u003ctd\u003ePatch and remediation history, supplier coordination and customer letter.\u003c\/td\u003e\n\n\u003ctd\u003eSwedish\u003c\/td\u003e\n\n\u003ctd\u003eDOCX + searchable PDF\u003c\/td\u003e\n\n\n\u003c\/tr\u003e\n\n\u003ctr\u003e\n\n\u003ctd\u003e6. Swedish user guide\u003c\/td\u003e\n\n\u003ctd\u003eCompletion, date logic, scope, secure handling and sources.\u003c\/td\u003e\n\n\u003ctd\u003eSwedish\u003c\/td\u003e\n\n\u003ctd\u003eDOCX + searchable PDF\u003c\/td\u003e\n\n\n\u003c\/tr\u003e\n\n\u003ctr\u003e\n\n\u003ctd\u003e7. English User Guide\u003c\/td\u003e\n\n\u003ctd\u003eEnglish instructions for the Swedish templates; not translated legal forms.\u003c\/td\u003e\n\n\u003ctd\u003eEnglish\u003c\/td\u003e\n\n\u003ctd\u003eDOCX + searchable PDF\u003c\/td\u003e\n\n\n\u003c\/tr\u003e\n\n\u003ctr\u003e\n\n\u003ctd\u003e8. CRA PSIRT\/SRP register\u003c\/td\u003e\n\n\u003ctd\u003e9 tabs: overview, products, intake, triage, SRP reporting, remediation, communication, evidence and sources.\u003c\/td\u003e\n\n\u003ctd\u003eSwedish\u003c\/td\u003e\n\n\u003ctd\u003eXLSX\u003c\/td\u003e\n\n\n\u003c\/tr\u003e\n\n\n\u003c\/tbody\u003e\n\n\n\u003c\/table\u003e\u003c\/div\u003e\n\u003ch2\u003eThe Excel tool in practice\u003c\/h2\u003e\u003cp\u003eThe workbook has filterable records, status fields, ID links and a formula-based overview. When an actual UTC time value is entered for when the manufacturer became aware of a reportable event, it shows the indicative 24h and 72h times. These are \u003cstrong\u003eabsolute technical control values, not a right to wait\u003c\/strong\u003e: report without unnecessary delay. The final report date is entered manually because the trigger differs: when a remediation is available (AEV) and when the 72h notification has actually been submitted (SI). The register distinguishes between draft, assessment, submitted notification and actual receipt.\u003c\/p\u003e\n\u003ch2\u003eStep-by-step workflow\u003c\/h2\u003e\u003col\u003e\n\n\u003cli\u003eIdentify legal manufacturer, product, version and authorized PSIRT\/SRP role.\u003c\/li\u003e\n\n\u003cli\u003eRecord sources and evidence without placing secrets or exploitation code in unsecured office files.\u003c\/li\u003e\n\n\u003cli\u003eAssess AEV and SI separately against CRA Article 14 and document the awareness timing.\u003c\/li\u003e\n\n\u003cli\u003eIf obligated: prepare the basis and report without unnecessary delay through \u003ca href=\"https:\/\/portal.cra-srp.enisa.europa.eu\/\"\u003eENISA's official SRP\u003c\/a\u003e.\u003c\/li\u003e\n\n\u003cli\u003eSave actual submission IDs and timestamps for 24h, 72h and applicable final report.\u003c\/li\u003e\n\n\u003cli\u003eDocument corrective remediation, affected users, communication and post-check.\u003c\/li\u003e\n\n\n\u003c\/ol\u003e\n\u003ch2\u003eLegal boundaries and responsibility\u003c\/h2\u003e\u003cp\u003e\u003ca href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX%3A32024R2847\"\u003eCRA (EU) 2024\/2847, Article 14\u003c\/a\u003e began to apply to manufacturers on 11 September 2026. Reporting obligation for actively exploited vulnerability requires relevant evidence of actual exploitation; a CVE number or high risk score is not automatically sufficient. Serious incident must be assessed according to Article 14.5. Early warning must be provided within 24h and notification within 72h from relevant awareness, both without unnecessary delay. For AEV, the final report must be submitted no later than 14 days after corrective or mitigating remediation is available. For SI, the final report must be submitted within one month after the actual 72h notification. Article 14.8 covers information to affected users.\u003c\/p\u003e\n\u003cp\u003eENISA's \u003ca href=\"https:\/\/www.enisa.europa.eu\/topics\/product-security\/vulnerability-services\/eu-incident-response-and-cyber-crisis-management\/single-reporting-platform-srp\/frequently-asked-questions\"\u003eSRP FAQ\u003c\/a\u003e and \u003ca href=\"https:\/\/www.enisa.europa.eu\/topics\/product-security\/single-reporting-platform-srp\/cra-srp-glossary2\"\u003efield glossary\u003c\/a\u003e should be checked directly before actual reporting because fields and platform features are updated. A Word or Excel status is never considered a submitted notification. The main other CRA requirements generally start to apply on 11 December 2027, and Article 24.3 for open-source software stewards follows a different start date. If necessary, a special assessment according to, for example, NIS2, GDPR and DORA is required.\u003c\/p\u003e\n\u003ch2\u003eDifference from our other documents\u003c\/h2\u003e\u003cp\u003eOur \u003ca href=\"\/en\/products\/cyber-resilience-act-cra-compliance-2026-2027-svenska-english-riskbedomning-sbom-incidentrapportering-word-pdf-excel\"\u003ebroader CRA Compliance package\u003c\/a\u003e covers risk assessment, SBOM, security requirements and overall CRA reporting. This new package is instead a specialized workflow for an actually received report or incident, SRP receipts, evidence and customer communication.\u003c\/p\u003e\n\u003ch2\u003eFrequently asked questions\u003c\/h2\u003e\u003ch3\u003eMust every security vulnerability be reported?\u003c\/h3\u003e\u003cp\u003eNo. Article 14 has special thresholds for actively exploited vulnerabilities and serious incidents. Other vulnerabilities may require internal handling, but are not automatically mandatory SRP notifications.\u003c\/p\u003e\u003ch3\u003eDoes the template send the notification to ENISA?\u003c\/h3\u003e\u003cp\u003eNo. The basis prepares and documents the work; an authorized representative must submit the notification via the actual SRP platform.\u003c\/p\u003e\u003ch3\u003eAre the PDF files editable?\u003c\/h3\u003e\u003cp\u003eThey are searchable and printable, but not interactive fillable forms. Use the Word files for editing.\u003c\/p\u003e\u003ch3\u003eIs all material translated into English?\u003c\/h3\u003e\u003cp\u003eNo. The five working documents and Excel are in Swedish. The English guide explains how the Swedish documents are used.\u003c\/p\u003e\n\u003ch2\u003eVersion, sources and transparency\u003c\/h2\u003e\u003cp\u003eRelease 1.0, 9 November 2026. AI-assisted legal source review of CRA Article 14, the Commission's reporting information and ENISA's SRP material on 9 November 2026. \u003cstrong\u003eNo external independent legal review, regulatory review or technical product certification has been performed.\u003c\/strong\u003e The package is an administrative support, not a guarantee of compliance.\u003c\/p\u003e","brand":"Svenska Dokumentmallar","offers":[{"title":"Default Title","offer_id":56558770979158,"sku":"CRA-PSIRT-ART14-2026-V1","price":79.0,"currency_code":"SEK","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0827\/2373\/3846\/files\/cra-psirt-artikel14-huvudbild-1600.jpg?v=1794221631","url":"https:\/\/mallbutiken.se\/en\/products\/cra-psirt-sarbarhetsrapportering-artikel14","provider":"Mallbutiken","version":"1.0","type":"link"}