24h Escalation Decision Diagram

CRA Article 14 — Severity triage and reporting escalation flowchart
Cyber Resilience Act (EU) 2024/2847 · Effective September 2026

How to use: Starting from the "Incident Detected" node, follow the decision branches. Each YES/NO path leads to the correct reporting window and escalation level. Use the severity definitions below to classify incidents correctly.

Severity Classification

🔴 Critical

Active exploitation confirmed. Significant user impact. Cross-border scope. → 24h + 72h + 14d reporting cascade.

🟠 High

Active exploitation likely. Multiple users affected. Single member state. → 24h + 72h reporting.

🔵 Moderate

Vulnerability confirmed, no active exploitation yet. Limited user impact. → 24h notification only.

Escalation Flowchart

⚡ INCIDENT DETECTED
Security event, vulnerability disclosure, or threat intel alert received
↓
Is this a product with digital elements
placed on the EU market?
YES ↓
NO →
Not CRA-applicable. Follow internal IR procedures.
Is the vulnerability being
actively exploited?
YES ↓
NO →
Monitor. No Article 14 reporting required yet. Document for internal records.
24h CLOCK STARTS
T+0h: Active Exploitation Confirmed
① Assign Incident Commander
② Draft initial CSIRT notification
③ Alert CRA Compliance Lead
↓
Is this a substantial incident?
Multiple users affected · Significant disruption · Cross-border impact
YES ↓
NO →
Submit 24h notification to CSIRT. Monitor for escalation. Close with follow-up report.
72h CLOCK STARTS
T+24h: Substantial Incident Confirmed
① Technical root cause analysis
② Impact assessment (users, scope, geography)
③ Draft substantial incident report
④ Submit to CSIRT within 72h
↓
Is this a significant incident?
Digital ecosystem impact · Essential services disrupted · Critical infrastructure involved
YES ↓
NO →
Close incident after 72h report. Internal post-mortem. Update playbook if needed.
14d CLOCK STARTS
T+72h: Significant Incident Confirmed
① Complete root cause analysis
② Develop and deploy permanent remediation
③ Draft comprehensive report (ENISA template)
④ Legal review and executive sign-off
⑤ Submit to CSIRT + ENISA within 14 days
↓
INCIDENT CLOSED
Post-Incident Review (T+14d to T+21d)
Lessons learned · Process improvements · Playbook update · CSIRT debrief

Decision Quick Reference

Question YES Path NO Path
Product with digital elements on EU market? Continue to active exploitation check Not CRA-applicable. Internal IR only.
Actively exploited? Start 24h clock → notify CSIRT Monitor. No Article 14 reporting.
Substantial incident? Start 72h clock → detailed report 24h notification sufficient. Close with follow-up.
Significant incident? Start 14d clock → CSIRT + ENISA Close after 72h report. Post-mortem.

Reporting Windows Summary

Window Trigger Report To Content Level
24h Active exploitation confirmed National CSIRT Initial notification — nature, products, preliminary impact
72h Substantial incident classified National CSIRT Detailed — root cause, impact assessment, remediation status
14d Significant incident classified CSIRT + ENISA Comprehensive — full timeline, preventive measures, lessons learned

Escalation Contacts

LevelTriggerContactChannel
L1 — On-call Any security event [SOC / PagerDuty] [Auto-alert]
L2 — IR Lead Confirmed active exploitation [IR Team Lead] [Phone + Slack]
L3 — Compliance 24h reporting threshold [CRA Compliance Lead] [Phone + Email]
L4 — Executive Substantial / significant incident [VP Eng + Legal] [Phone + In-person]
L5 — CSIRT Article 14 reporting obligation [National CSIRT] [Portal + Email]
L6 — ENISA Significant incident ENISA incident@enisa.europa.eu

Diagram provided by debored.ai — CRA Concierge Service. This diagram is a general guide based on Article 14 of the Cyber Resilience Act (Regulation EU 2024/2847). Adapt the escalation paths and contacts to your organization's structure and national CSIRT requirements. Not legal advice.

Need help setting up these workflows? Learn about CRA Concierge →