Verdict and legal basis
The verdict is the mechanical consequence of the two qualification answers. The table is explicit and hides no grey areas: the same answers always give the same outcome, which is why the reasoning is defensible.
The decision table
| Step 1 · nature | Step 2 · precondition | Verdict | Legal basis |
|---|---|---|---|
| Neither of the two | — | no obligation | — |
| Vulnerability | Documented active exploitation | obligation | Art. 14(2)(a) |
| Vulnerability | Only reported, no exploitation | no obligation | — |
| Vulnerability | Insufficient elements | suspended | to be reassessed |
| Serious incident | Security properties compromised | obligation (incident) | Art. 14(4)(a) |
| Serious incident | No impact on security | no obligation | — |
| Serious incident | Insufficient elements | suspended | to be reassessed |
Neither branch produces an obligation without a confirmed answer at step two: qualifying an event as a «serious incident» is not by itself enough to trigger the notification. The precondition has to be established.
Obligation to notify
The case moves to obligation, the 24-hour clock is running, and the verdict screen states:
- the applicable legal basis — Art. 14(2)(a) for an exploited vulnerability, Art. 14(4)(a) for a serious incident;
- the recipient — the national CSIRT and ENISA through the single reporting platform;
- the deadline computed from the moment of awareness;
- the next actions: prepare the notification, notify affected users, report upstream if the defect sits in a third-party component.
The outcome alert goes to the contact, and the sequence of clock reminders is armed.
No obligation
The case is archived with the reasoned verdict. It is not a deletion: it stays consultable and the verdict stays in the registry. In a later inspection, being able to show that the event was examined and found out of scope is worth as much as a filed notification.
Good practice. In the justification write the decisive element, not the conclusion: «no known exploit, PoC does not work on supported versions, confirmed with the researcher» is useful; «not applicable» is not.
Suspended
The case stays open under assessment and a re-check reminder is set for the contact. Resume as soon as the missing element arrives: confirmation of exploitation, the team's finding, the reporter's answer.
Suspension does not suspend the statutory deadline. If the precondition is later confirmed, the 24 hours remain anchored to the original moment of awareness, not to when you resolved the doubt. Treat a suspension as a race against time, not as a pause.
The verdict history
Every concluded triage appends a row to the case history: moment, answers given, outcome, legal basis, moment of awareness applied, author and justification. Rows accumulate, they do not replace each other. This is the reconstruction of how the assessment evolved as information arrived — the evidence that yours was active management and not an omission.
After the verdict
With an established obligation the next step is the notification draft. If the defect sits in a third-party component, or there are users to warn, see also User notice and upstream chain: these are duties distinct from the notification to the authority and are tracked separately.