Meldora
Book a call

The ENISA notification step by step

The manufacturer submits through the Single Reporting Platform. Meldora provides the texts and tracks the deadlines; below is the whole procedure, including the parts the portal cannot show.

Before anything happens

  1. Register the company on the SRP in advance. An EU Login account with MFA for the responsible person (primary representative) and a backup (up to 20 additional). Registration takes time, and once a vulnerability is found you have 24 hours. Do it in the first week of the service.
  2. Decide who decides. Appoint the person who confirms “becoming aware” and submits the notification. Enter them as the emergency contact in Meldora.
  3. Prepare the product data. Name and versions, EU Member States where the product is made available, product type, support period. Meldora inserts them into the texts automatically if they are filled in on the product.

The three notification stages

  1. Early warning, within 24 hours of becoming aware. Sign in to the SRP, choose “Actively exploited vulnerability”, paste the fields from the report (title, summary, Member States, product and version, date of becoming aware). Submit even if you lack some details. Confirm the submission in the report and enter the notification number.
  2. Vulnerability notification, within 72 hours of becoming aware. Complete the same notification: general product information, nature of the exploitation, initial severity and impact assessment, measures taken, recommendations for users. Confirm the submission in the report.
  3. Final report, within 14 days of the fix being available. After the update is released: description of the vulnerability, the malicious actor (if known), description of the update and the date it became available. After submission the notification is closed and cannot be edited. Confirm in the report.
  4. Inform the users. Without undue delay after the early warning: a notice about the vulnerability, interim recommendations and the availability of the update. The ready text is in the report.

What to watch out for

  • The 72 hours run from becoming aware, not from submitting the early warning. The platform's counter may show a different time.
  • One notification covers one vulnerability. Two vulnerabilities in one product mean two notifications.
  • A draft on the SRP is visible only to the person who created it. If that person is away, the second representative has to start over; keep the texts in Meldora.
  • Nothing can be corrected after the final report is submitted. Check the data before the last stage.
  • The platform works in English; Meldora's texts are in English by default.
  • Keep the notification numbers and confirmations; enter them in the report, they go into the order log.

When the platform is down

  1. Check the notices on ENISA's site and try again after a few minutes.
  2. Call the coordinator CSIRT designated for Poland (contact details are published by ENISA on the SRP page; for most manufacturers it is CSIRT NASK, cert.pl) and pass the early-warning content verbally or by e-mail if the CSIRT says so.
  3. Note in a message to the consultant the time of the attempt, who called and what was agreed; it goes into the order log.
  4. Once the platform is back, submit the notification and mention the outage and the earlier CSIRT contact in the description field.

Sources