Blog · CRA
CRA: articles and guides.
Every CloudSoul article on CRA, newest first.
CRA reporting obligations: what manufacturers must report since 11 September 2026, to whom and how fast
Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents in their products: early warning in 24 hours, notification in 72 hours, then a final report. What counts, who receives it, and how NIS2 fits.
NIS2 coordinated vulnerability disclosure: what Article 12 sets up, and what your company must do about vulnerabilities
NIS2 Article 12 makes one CSIRT per country the coordinator for vulnerability reports and has ENISA run a European vulnerability database. Article 21 makes companies handle and disclose vulnerabilities. What each means, the CRA link and a policy template.