Never miss a CRA reporting deadline for your firmware
For small makers of connected devices without a security team. When someone reports a flaw, you see which firmware versions it affects. You also get reminders before the 24h and 72h deadlines and a draft notice to start from.
Full refund on request any time before delivery. Target delivery: 31 January 2027.
Your draft is ready. It already lists the 2 affected firmware versions.
Check it, then send it on the ENISA platform.
Set it up once. Use it when a report comes in.
Most of the work happens before anything goes wrong.
Add your firmware
List your products and firmware versions. Upload a CycloneDX or SPDX SBOM for each version.
Get reports in one place
You get a hosted security.txt and a disclosure page with a report form. Each report opens an incident.
Beat the clock
Pick the affected versions using the SBOMs. The timers start, reminders go out and the drafts fill in.
The CRA gives you 24 hours, then 72 hours.
Since 11 September 2026, CRA Article 14 has set two deadlines. They apply once you become aware of an actively exploited vulnerability or a severe incident. You must send an early warning within 24 hours and a notification within 72 hours.
For a small team, three things are hard. You need to know which shipped firmware versions are affected. You need to know which coordinator CSIRT to report to. And you must not miss the deadlines.
For most small makers, this happens rarely. That is the risk: when it does happen, nobody remembers the steps. That's why the plan is yearly and includes a practice run every year.
A missed deadline is a compliance problem you can't fix later.
What version 1 will and will not do
None of this is built yet. Everything below is planned.
v1 will (planned)
- Products and versions. Keep a list of your products and their firmware versions.
- SBOM per version. Upload CycloneDX or SPDX files.
- Disclosure page. A hosted security.txt and disclosure policy page with a report form.
- Affected versions. See which versions are affected, based on their SBOMs.
- 24h and 72h timers. Countdowns with email reminders.
- Notice drafts. Prefilled in the ENISA format.
- Yearly drill. A practice incident, with a reminder each year.
- Evidence log. Export it as PDF or CSV.
v1 will not
- Submit notices to ENISA for you
- Be a full compliance suite
- Give legal advice
You review and send every notice yourself. The kit gives you templates and timers.
One year of the kit, paid once
Your year starts when you get access, not when you pay.
Good fit: small EU makers of connected hardware that ship firmware updates and have no security staff.
Not a fit: teams that need a full compliance suite or legal advice.
Founding access
€290/ first year
Renews at €290 a year, or €29 a month if you prefer.
- All planned v1 features
- A yearly drill reminder
- Your year starts on delivery
Pre-order terms
- The product is not built yet.
- Target delivery: 31 January 2027.
- Full refund for any reason, on request, at any time before delivery.
- If it's not delivered by 31 January 2027, you get a full refund automatically. You don't need to ask.
- Templates and timers, not legal advice. Notices are not sent to ENISA for you.
Payment is handled by Stripe on a secure checkout page. Checkout asks two short questions, about your SBOM tools and any past exploited vulnerabilities. The answers are used only to shape the product.
Not ready to pay? Get notified.
Questions
Does it send the notices to ENISA for me?
No. It prepares the drafts and reminds you of the deadlines. You check each notice and send it yourself.
Is this legal advice?
No. The kit gives you templates and timers. Check your duties with a lawyer if you are unsure.
We rarely get vulnerability reports. Is it worth it?
Your disclosure page and report form are live all year. The yearly drill keeps the steps fresh, so you're ready the day a real report arrives.
Which SBOM formats will it read?
CycloneDX and SPDX. You upload one file per firmware version.
What if I change my mind?
Ask for a refund any time before delivery and you get it all back. Write to [email protected].
Who's behind it
Georgi Dimitrov, a senior software developer, is building this under the Korenda name as an independent side project. Questions are welcome at [email protected].
Privacy
Templates and timers, not legal advice.
Stripe handles payment. We never see your card details. This site uses cookieless analytics. If you sign up for updates, your email address is used only to tell you about this product.
CycloneDX, SPDX and ENISA are named only to describe file formats and the reporting process. Korenda has no ties to these projects or to ENISA, and they do not endorse it.