Could you report an exploited vulnerability within 24 hours?

1. Do you know which of your products sold in the EU contain software or connect to a network, and so count as products with digital elements under the CRA?

   YesPartlyNo or not sure
2. Is a named person or small team authorised to decide, within hours, whether a vulnerability is actively exploited and must be reported?

   YesPartlyNo or not sure
3. Can customers and security researchers report a vulnerability to you through a published contact or disclosure policy?

   YesPartlyNo or not sure
4. Do you know which software components, including open-source libraries, are in each product and version?

   YesPartlyNo or not sure
5. Could you tell, within a day, which products, versions and customers a new vulnerability affects?

   YesPartlyNo or not sure
6. Do you know how an early warning is submitted through ENISA’s single reporting platform, and who in your company submits it?

   YesPartlyNo or not sure
7. Can you ship a security update for affected products and tell users how to apply it?

   YesPartlyNo or not sure
8. Have you rehearsed the 24-hour and 72-hour sequence in an exercise within the last year?

   YesPartlyNo or not sure

0 of 8 answered