Initial setup
Seven things need doing before the first real report arrives. Together they take about an hour, and they are exactly what the application's setup checklist keeps an eye on.
The list
| # | Step | Where | Why |
|---|---|---|---|
| 1 | Register the products | Products | A case attaches to a product: without the register you cannot fill in the notification. |
| 2 | Set the escalation chain | Account area › Company and people › People | It decides who gets the reminders and when counsel is brought in. |
| 3 | Invite colleagues with roles | Account area › People | No 24-hour process survives on one person. |
| 4 | Publish the public form | Account area › Embedded form | It is the coordinated-disclosure channel: without it, reports land wherever. |
| 5 | Prepare the filing prerequisites | Filing | Institutional credentials cannot be obtained in 24 hours. |
| 6 | Enable two-step verification | Account area › Security | Access to the evidence file must be protected. |
| 7 | Rehearse the flow | Menu › Exercise | It proves all of the above actually works. |
1. Register the products
In Products, enter the products with digital elements you place on the market: name, version, identifiers (serial number, part number, barcode, MAC address where relevant), category, release date and end of the support period. The full field list is in Product register.
Start from what is actually on the Union market, not from the historical catalogue. Four well-kept products beat forty rows copied out of an ERP.
2. The escalation chain
In People you set four addresses with distinct functions:
Use addresses that are watched out of hours. The 24 hours do not pause at night or at weekends: if the contact is a mailbox read only in the office, the chain is already broken.
3. Users and roles
Invite at least a second administrator and the assessors who will run the triage. Give «Read-only» to those who only consult (compliance, outside counsel). See Users, roles and escalation.
4. The public form
In Account area › Embedded form, customise the mail alias, the introductory text and the fields, then copy the <iframe> snippet into your site's security page. The same screen provides the content of the security.txt file to publish at /.well-known/security.txt. Details in Public reporting form.
5. The filing prerequisites
The Filing screen carries a checklist with two entries: an EU Login account enabled for the single reporting platform, and the contact point at the national CSIRT. They are informational ticks — they never block a filing — but resolve them ahead of time, because activating institutional credentials takes days, not hours.
6. Two-step verification
Enable it for every user who can write. Procedure in Sign-in, SSO and two-step verification.
7. The dress rehearsal
Switch on exercise mode and take a fake case all the way to filing. Time it: if it takes more than a couple of hours from report to finished text, the bottleneck is organisational and needs fixing now.