Glossary
The words of the Regulation and those of the application, with the translation from one to the other. Where the technical meaning differs from common usage, the difference is stated: that is almost always where qualification errors start.
The Regulation
Cyber Resilience ActRegulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements.
Product with digital elementsA software or hardware product, and its remote data processing solutions, placed on the Union market.
ManufacturerWhoever develops or has developed a product and markets it under their own name or trademark. The subject on whom the Art. 14 duties fall.
Actively exploited vulnerabilityA vulnerability for which there are elements attesting to actual use by third parties. The precondition of the obligation under Art. 14(2)(a).
Serious incidentAn event that compromised the availability, integrity or confidentiality of the product or of the data it processes. The precondition under Art. 14(4)(a).
Early warningThe first communication, due within 24 hours of the moment of awareness.
Support periodThe span during which the manufacturer guarantees vulnerability handling for the product.
Software bill of materials (SBOM)A structured list of the components a software product is made of.
Coordinated disclosureThe practice by which a finder reports a vulnerability to the manufacturer and agrees the timing and manner of publication.
CSIRTThe national computer security incident response team, a recipient of reports alongside ENISA.
ENISAThe European Union Agency for Cybersecurity. It operates the single reporting platform.
Single Reporting PlatformThe platform on which Art. 14 reports are filed.
EU LoginThe authentication system of the European institutions, needed to access the platform.
The application
CaseThe unit of work: one reported event with its product, chronology and deadlines.
OrganisationThe container of a customer's data: cases, products, registry, settings. Data never crosses the organisation boundary.
TriageThe guided three-step qualification that leads to the verdict.
Gate (step)Each of the three triage questions: nature of the event, precondition of the obligation, start of the deadline.
VerdictThe triage outcome: obligation, incident obligation, suspended, no obligation.
Moment of awarenessThe documentable instant at which the company learnt of the fact. The 24 hours run from here.
ClockThe countdown of the current phase, anchored to the expiry computed by the server.
Obligation phaseEarly warning, 72-hour update, final report, fulfilled.
Activity registryThe organisation's book of acts, with an integrity chain.
Integrity chainThe cryptographic chaining of registry rows that makes any alteration evident.
Defence dossierThe printable document gathering everything about a case.
Escalation chainThe four addresses — contact, deputy, legal representative, security mailbox — that alerts go to.
Taking chargeThe declaration by which the contact suspends escalation on a deadline they are handling.
Public formThe embeddable reporting page tied to your organisation by a non-enumerable code.
SignalAn inbound event (public form, connectors, API, intelligence) that lands in the INCOMING queue (
/signals) and is not yet a case: no statutory clock runs until a person promotes it to a case, attaches it to an existing case, or disposes of it.QuarantineThe condition of an external signal while it stays unpromoted (INCOMING) and its attachments untrusted: it does not exist as a case and starts no clock until a person reviews and promotes it.
Exercise modeThe dress rehearsal: everything works, traces are marked, counsel stays out.
Setup checklistThe seven steps that measure how ready the organisation is.
False friends
| Do not confuse | With | Difference |
|---|---|---|
| Reported vulnerability | Exploited vulnerability | Only the second triggers the Art. 14(2)(a) obligation. |
| Notification to the authority | Notice to users | Distinct duties, different recipients: one does not replace the other. |
| Early warning filed | Obligation discharged | After the early warning the 72-hour update and the final report remain. |
| Suspended | Deadline suspended | The suspension concerns your assessment, not the running of the statutory deadline. |
| Role (permissions) | Escalation address | The first says what can be done, the second who gets alerted. |