EU cyber-resilience rules start 24-hour vulnerability reporting deadline
PolicyUnverifiedUpdated:
A report says Article 14 of the EU Cyber Resilience Act has made mandatory incident reporting applicable, replacing a period before those reporting duties were in force for covered products with digital elements.
An early warning within 24 hours of awareness
The Register reports that manufacturers making products with digital elements available in the EU must now report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform. The reported rules require an early warning within 24 hours of awareness and a more detailed notification within 72 hours, subject to exemptions.
The Article 14 reporting duties were not yet applicable.
According to the report, covered manufacturers now face a 24-hour early-warning deadline and a 72-hour detailed-notification deadline after learning of an actively exploited vulnerability or severe security incident.
The reported clock starts when the manufacturer becomes aware of exploitation or a severe incident. Subject to exemptions, the duties concern covered products even when their manufacturer is based outside the EU.
Sources
- The RegisterEU's Cyber Resilience Act starts the 24-hour vulnerability clockRead source →