Ready before the first 24 hours, not during them
2 of 4 done — each step is checked against the register itself.
- List the products and systems in scope
- Name who notifies, and their deputy
- Record your national authority
- Keep the vulnerability register current
Overdue
1
past a statutory deadline
Due within hours
0
nothing due in the next 6 hours
Clocks running
4
across 5 open incidents
Exploited, no fix yet
2
the 14-day clock cannot start
Deadline alerts are off: nobody is emailed as these clocks run down. Switch them on in Settings.
Running now
Every incident →
INC-20261108-3B15
high
Actively exploited deserialization flaw in libsignalproc as bundled
Aware 2026-11-08 10:13:57 UTC · CRA — actively exploited vulnerability
2d 0h ago
Vulnerability notification · Article 14(2)(b)
due 2026-11-11 10:13:57 UTC
INC-20261111-EF2C
critical
Exploited authentication bypass in the gateway management interface
Aware 2026-11-11 18:13:57 UTC · CRA — severe incident + NIS2 — significant incident
in 31h
Incident notification · Article 14(4)(b)
due 2026-11-14 18:13:57 UTC weekend
INC-20261112-C810
medium
Support ticket export sent to the wrong customer
Aware 2026-11-12 04:13:57 UTC · GDPR — personal data breach
in 47h
Notification to the supervisory authority · Article 33(1)
due 2026-11-15 10:13:57 UTC weekend
INC-20261104-B10C
medium
Credential stuffing against the customer support portal
Aware 2026-11-04 10:13:57 UTC · NIS2 — significant incident
in 23d 12h
Final report · Article 23(4)(d)
due 2026-12-06 23:13:57 UTC
INC-20261110-8E50
critical
Memory corruption in the gateway TLS stack under crafted handshakes
Aware 2026-11-10 10:13:57 UTC · CRA — actively exploited vulnerability
Actively exploited, no corrective measure yet
2The CRA's 14-day final-report clock runs from the moment a corrective or mitigating measure is available — so for these it has not started. That is not the same as having nothing to do.
What applies, and when
- CRA Article 14 — reporting obligations Regulation (EU) 2024/2847 · in force since 2026-09-11 binding
- NIS2 Article 23 — incident reporting Directive (EU) 2022/2555, as transposed · in force since 2024-10-17 binding
- GDPR Article 33 — personal data breaches Regulation (EU) 2016/679 · in force since 2018-05-25 binding
- DORA Article 19 — major ICT-related incidents Regulation (EU) 2022/2554 · in force since 2025-01-17 binding
These clocks run continuously. Neither CRA Article 14 nor NIS2 Article 23(4) has a
working-day carve-out, so a deadline can and does fall at a weekend — the register marks the ones that do.
NIS2 is a Directive: what binds you is your Member State's transposition (Germany).
The pack
Every incident, every stage, every deadline and what was actually sent — the file an authority asks for.
Reporting register (CSV) Vulnerabilities (CSV) Evidence manifest (CSV)