[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fK_UaSeIor7bxWK3rj9nTXk_gwAip_9S9j5D7MMN6bAk":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":51},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"20343bcb-0ccb-49fc-a95e-a79f3f10b203","The Cyber Resilience Act clock doesn’t stop for weekends","the-cyber-resilience-act-clock-doesn-t-stop-for-weekends-32ad8a","In this Help Net Security interview, Aurimas Bakas, CEO of Copla, talks about what the EU Cyber Resilience Act‘s reporting duties mean for manufacturers. He explains why companies need a register of every product version still in use, why boards focus on CE marking while reporting obligations started in September 2026, and how to define the moment a company becomes aware of an exploited flaw. He also covers what CISOs should ask suppliers, and how … More → The post The Cyber Resilience Act clock doesn’t stop for weekends appeared first on Help Net Security.","The EU Cyber Resilience Act's reporting duties, which began in September 2026, require manufacturers to maintain a register of every product version still in use, even those no longer sold. Companies must define 'awareness' of an exploited flaw and ensure a designated person can file a 24-hour early warning report on any day of the year, including weekends. Failure to comply can result in fines of up to €15 million or 2.5% of turnover.","EU Cyber Resilience Act reporting duties require manufacturers to track all product versions still in use.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F11\u002Faurimas-bakas-copla-cra-vulnerability-reporting\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002F10093912\u002Faurimas_bakas-2-copla.webp","2026-11-11T07:00:54+00:00","2026-11-11T08:00:22.549164+00:00",7,[17,20],{"name":18,"type":19},"Copla","vendor",{"name":21,"type":22},"CE marking","technology","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"4fd32ef4-29b8-4ee4-b88f-ecfb77fbf9c1","NIS2","nis2",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"ef42c16c-f41b-4794-8148-5fa5cb7b41b0","Cyber Resilience Act","eu-cyber-resilience-act",[],[18],{"controls":49,"vendors":50},[],[],{"slug":52,"title":53,"body":54,"framework_refs":55,"framework_notes":61},"eu-cyber-resilience-act-demands-247-incident-reporting-readiness","EU Cyber Resilience Act demands 24\u002F7 incident reporting readiness","The EU Cyber Resilience Act (CRA) introduced mandatory 24-hour early warning reporting for actively exploited vulnerabilities, effective September 2026, with no exemptions for weekends or holidays. Many manufacturers are unprepared because they lack both the operational processes to detect 'awareness' of exploitation in real time and designated personnel available around the clock to file reports. Additionally, maintaining a version register for every product still in use—even discontinued ones—adds a significant ongoing inventory burden that most companies have not planned for. Non-compliance risks fines of up to €15 million or 2.5% of global turnover, making this a material business risk, not just a procedural one. Organizations that treat regulatory deadlines as a future problem rather than a present operational requirement will find themselves exposed when an incident occurs on a Saturday night.",[56,57,58,59,60],"NIS2 Article 21(2)(b)","NIS2 Article 21(2)(e)","NIST SP 800-53 IR-6: Incident Reporting","CIS Control 17: Incident Response Management (v8)","ISO\u002FIEC 27001:2022 A.5.25: Assessment and decision on information security events",{"NIS2 Article 21(2)(b)":62,"NIS2 Article 21(2)(e)":63,"NIST SP 800-53 IR-6: Incident Reporting":64,"CIS Control 17: Incident Response Management (v8)":65,"ISO\u002FIEC 27001:2022 A.5.25: Assessment and decision on information security events":66},"NIS2 Article 21(2)(b) requires entities to have incident handling procedures, including timely notification obligations, which directly parallels the CRA's 24-hour early warning reporting duty and the need for around-the-clock operational readiness.","NIS2 Article 21(2)(e) covers vulnerability handling and disclosure practices, which is precisely what the CRA formalises by requiring manufacturers to track exploitation of flaws across all active product versions and report within 24 hours.","IR-6 requires organizations to report security incidents to authorities within defined timeframes, directly mapping to the CRA's 24-hour early warning requirement and the need for a designated, always-available reporting person.","CIS Control 17 calls for a documented incident response capability including defined roles and communication procedures, which is exactly what organizations need to reliably meet the CRA's mandatory weekend-inclusive reporting deadlines.","This control requires organizations to assess information security events and decide on classification and response, supporting the consistent internal definition of 'awareness' of exploitation that starts the CRA's reporting clock."]