Article 14 readiness checklist

Before a report exists

• Name the product, the versions still in customers' hands, and who the manufacturer is.

  The notification is about a product with digital elements you made available, not about the company in the abstract.

  Product with digital elements

• Write the three roles: who may record awareness, who decides to report, and who submits, each with a backup.

  The 24-hour clock does not wait for the usual approver to come back from leave.

  Becoming aware

• Agree what evidence is enough to call a case actively exploited, and where that note is stored.

  A later reader has to see why the clock was started.

  Actively exploited vulnerability

• Know which inbox is monitored, by a person, including outside office hours.

  Awareness is a fact about your team, not about a tool that files mail unread.

  Vulnerability handling

• Confirm who can sign in to the Single Reporting Platform, and where the password is if that person is unavailable.

  The notification is submitted there, once, not by email to each country.

  Single Reporting Platform

Within 24 hours

• Record the time you became aware, and who recorded it.

  Both deadlines are counted from that time.

  Becoming aware

• Say whether this is an actively exploited vulnerability or a severe incident.

  The final report uses a different rule for each. The early warning should not blur them.

  Severe incident

• Name the Member States where you know the product has been made available, if you know them.

  The early warning asks for that where it applies. Do not hold the alert until the list is perfect.

  Early warning

• Have one person approve the text, then submit it on the platform.

  The early warning is a short alert. It is not the root-cause analysis.

  Early warning

Within 72 hours

• Describe the product and the general nature of the exploit or incident.

  The 72-hour notification is where that general picture goes, unless you already sent it.

  Notification (72 hours)

• State the corrective or mitigating measures already taken, and the measures users can take.

  The notification asks for both, as far as you know them at 72 hours.

  Notification (72 hours)

• Mark how sensitive you consider the information.

  Article 14 asks the manufacturer to indicate that sensitivity.

  Notification (72 hours)

Final report

• If it is an actively exploited vulnerability, date the day a corrective or mitigating measure became available, and file within 14 days of that day.

  The vulnerability final report is tied to the measure, not to a fixed number of days after awareness.

  Final report

• If it is a severe incident, file within one month of the 72-hour notification.

  The incident final report does not use the 14-day rule.

  Final report

• Keep a copy of what was submitted, when, and who approved it.

  The platform is the filing. Your own record is how you show the clocks were met.

  Single Reporting Platform

• Tell the people who use the product. Do not treat the platform filing as that message.

  Notifying the CSIRT and ENISA is a separate act from informing users.

  Early warning

Send me the checklist

Usama

Founder of Samisoftz. He writes these pages and builds the software. About Usama