ENISA SRP

ENISA Single Reporting Platform readiness for CRA

The ENISA Single Reporting Platform is a web-based reporting destination for CRA notifications. Cramio prepares, validates, approves, and evidences the filing workflow; an authorised person completes submission in the official portal.

Reviewed 2026-07-25Editorial owner: Cramio compliance team
One entry point
The SRP centralises CRA notifications for the relevant CSIRT and ENISA
Web filing
Cramio does not claim a private direct-submission API
11 Sep 2026
The platform and mandatory Article 14 reporting become operational
Operating model

From obligation to auditable execution

1

Assemble the case

Resolve manufacturer, coordinator CSIRT, product, versions, occurrence type, awareness time, and available facts.

2

Validate and approve

Check required fields, data classification, consistency, and legal approval in a maker-checker workflow.

3

Complete official filing

An authorised representative transfers the approved facts into the official SRP and submits them.

4

Capture proof and continue

Record the SRP reference and receipt, preserve the filed snapshot, and manage follow-up and final reporting.

01

What teams need before submission

A strong SRP workflow starts before the portal. Teams need product identity, vulnerability facts, discovery timestamps, affected versions, remediation status, and internal approvals ready in a structured format.

  • Product and manufacturer identity details.
  • Vulnerability, exploit, and incident facts connected to product versions.
  • Review and approval workflow before external submission.
Control outcomeThe filing operator receives a complete, approved, portal-ready case rather than collecting facts under deadline pressure.
02

How cramio prepares SRP reports

cramio organizes product, SBOM, vulnerability, incident, and evidence data so teams can draft CRA reports quickly and consistently. It generates portal-ready packages and stores the confirmation reference entered after an authorised person files through the official portal.

  • Early warning facts for the 24-hour reporting window.
  • Expanded technical and impact details for 72-hour full notifications.
  • Final report evidence including remediation and root-cause information.
Control outcomeAutomation supports preparation and assurance without misrepresenting Cramio as the official reporting channel.
03

Control sensitive regulatory data

Vulnerability and incident reports may contain exploit details, affected versions, architecture information, personal data, or commercially sensitive facts. Access should follow least privilege, and the filing package should contain only information required and appropriate for the relevant stage.

  • Apply role-based access, tenant isolation, encryption, and auditable approvals.
  • Separate internal investigation notes from the approved external submission dataset.
  • Retain filed versions and receipts under a documented retention and deletion policy.
Control outcomeSensitive incident data is limited to authorised participants and each external disclosure is deliberate and reviewable.
04

Evidence matters after submission

Regulatory reporting does not end at submission. Teams need proof of timing, approval, remediation, and follow-up decisions. Evidence records support audits, management review, and future incident response improvement.

  • Store report versions, timestamps, decisions, and receipts.
  • Link reports to products, SBOMs, incidents, and VEX statements.
  • Maintain a consistent audit trail for CRA readiness.
Control outcomeThe organisation can prove what was submitted, when, by whom, under whose approval, and what remediation followed.
05

Plan for portal and connectivity disruption

The official platform is an external dependency. Teams should keep an approved export, named filing operator, secure communication channel, and escalation path ready if the portal or a local system becomes unavailable close to a deadline.

  • Record failed submission attempts and screenshots or references without exposing secrets.
  • Monitor official ENISA and coordinator-CSIRT instructions during disruption.
  • Reconcile the official receipt back into Cramio as soon as submission succeeds.
Control outcomeAn external outage does not erase the organisation’s evidence of timely preparation, escalation, and filing attempts.

Common questions

What is ENISA SRP?

ENISA SRP refers to the Single Reporting Platform used for structured cybersecurity reporting workflows connected to EU regulatory obligations, including Cyber Resilience Act reporting.

Does cramio submit directly to ENISA?

No. The CRA SRP does not provide Cramio with a direct submission API. Cramio prepares and validates the package, manages approval and deadlines, guides an authorised person to the official web portal, and records the resulting confirmation evidence.

Why prepare SRP data before an incident?

CRA reporting windows are short. Preparing product inventory, SBOMs, ownership, templates, and evidence workflows before an incident reduces missed deadlines and incomplete submissions.

Who receives an SRP notification?

The manufacturer selects the CSIRT designated as coordinator based on its main establishment; the platform supports the CRA’s distribution to that CSIRT and ENISA and onward handling under the regulation.

Primary sources

This educational material supports operational readiness and is not legal advice. Customers remain responsible for determining how the CRA applies to their products and obligations.