Discuss a project

Enki Tech resource · CRA incident readiness

CRA 24/72h Incident Dry-Run Checklist

A compact technical checklist for testing whether an organisation can move from awareness of an actively exploited vulnerability or severe product-security incident to owned decisions, reporting data, SRP access, remediation and evidence.

View the readiness sprint

How to use it

Run the workflow against one realistic scenario and use a clock

Agree a simulated scenario with the client reporting owner, then expose operational delay: missing product mapping, unclear authority, unavailable evidence, fragile SRP access, weak handoffs and remediation steps that depend on a single person.

Operational update · 10 September 2026

Include the submission access path in the dry run

Prepare personal EU Login accounts with MFA and a backup handoff. ENISA recommends registering on the SRP when a real notification is needed. Rehearse using offline templates, without submitting a test notification. Where representatives already have access, review the actual role permissions rather than assuming backups can see every report.

ENISA SRP FAQ · ENISA user-registration guidance

Check
Control point
What to test
Evidence source
Result
01
Awareness time
Preserve the earliest relevant awareness timestamp and source. Internal triage or approval must not reset the clock.
Name the authoritative system, access record, document or decision record.
Green / Amber / Red
02
Event classification
Determine whether the scenario is an actively exploited vulnerability, a severe product-security incident or neither.
Name the authoritative system, access record, document or decision record.
Green / Amber / Red
03
Product and version mapping
Identify affected product families, versions, components and markets using the organisation’s source of truth.
Name the authoritative system, access record, document or decision record.
Green / Amber / Red
04
Primary and backup ownership
Name the operational owner, decision authority and backup path if a key person is unavailable.
Name the authoritative system, access record, document or decision record.
Green / Amber / Red
05
SRP preparation
Check personal EU Login/MFA preparation and representative responsibilities. Use offline templates for the exercise; follow ENISA guidance on registration timing and existing access.
Name the authoritative system, access record, document or decision record.
Green / Amber / Red
06
24-hour data package
Test whether the minimum technical facts for an early warning can be assembled inside the first reporting window.
Name the authoritative system, access record, document or decision record.
Green / Amber / Red
07
72-hour data package
Validate deeper impact, mitigation status, affected scope and evidence for the main notification workflow.
Name the authoritative system, access record, document or decision record.
Green / Amber / Red
08
Remediation ownership
Connect reporting to corrective or mitigating action, engineering ownership, validation and backlog tracking.
Name the authoritative system, access record, document or decision record.
Green / Amber / Red
09
Final-report path
Vulnerability: track 14 days from corrective-measure availability. Severe incident: track one month from the incident notification. Retain the relevant anchor timestamp and assign the final-report owner.
Name the authoritative system, access record, document or decision record.
Green / Amber / Red
10
Evidence retention
Confirm that key decisions, timestamps, owners, technical findings and remediation evidence can be reconstructed later.
Name the authoritative system, access record, document or decision record.
Green / Amber / Red
11
Timed re-test
Repeat the scenario after improvements and compare retrieval time, access readiness, handoff quality and evidence completeness.
Name the authoritative system, access record, document or decision record.
Green / Amber / Red

Simple readiness scoring

Score the process—not the team

Green · The owner, source system, access path and evidence are known; the step can be completed within the target time without heroic effort.
Amber · The step is possible but depends on manual correlation, unclear ownership, one key person, fragile access or slow evidence retrieval.
Red · The organisation cannot reliably complete the step inside the required workflow or cannot produce defensible evidence.

Evidence principle

If evidence requires a two-week audit scramble, it is not 24-hour ready.

The strongest remediation opportunities usually sit between tools and teams: vulnerability intelligence that is not linked to product inventory, tickets without clear authority, evidence that lives in screenshots, access that depends on one person, or decisions that depend on one senior engineer being available.

Scope boundary

Technical readiness is only one part of CRA compliance

This checklist is an operational engineering aid. It does not provide legal advice, determine reportability on behalf of a manufacturer, submit notifications, or certify compliance. Legal interpretation and regulatory responsibility remain with the manufacturer and its authorised advisers.

Run a technical dry runDiscuss scope