CRA Readiness Program | Cranial Thunder

The Mechanics

Two Triggers. Three Deadlines. One Platform.

Legally binding from 11 September 2026, retroactive to products already on the market. Both triggers — an actively exploited vulnerability, or a severe incident — route through ENISA's Single Reporting Platform to your CSIRT coordinator, simultaneously.

Stage	Deadline	What's Required
Early Warning	24 hours	From the moment you become aware. Which Member States the product reaches; for incidents, whether malicious or unlawful cause is suspected.
Detailed Notification	72 hours	Product info, nature of the exploit or vulnerability, mitigating measures taken and available to users, and how sensitive you consider the information.
Final Report	14 days after fix / 1 month after resolution	Root cause, corrective measures, preventive measures.

Self-Assessment

The Questions That Matter

Most companies find out during a tabletop exercise, not before one, whether they can actually answer these.

Are you actually the "manufacturer" under the CRA — or could that duty sit with a distributor or OEM partner instead?

White-label, private-label, and group-structured arrangements can put the reporting duty on a different legal entity than the one you think of as "us."
Do you know your CSIRT coordinator — the one tied to your main establishment?

Every submission routes to a specific national CSIRT, plus ENISA, simultaneously. If nobody in the room can name it, that's the gap.
Do you have — or a plan to get — access to ENISA's Single Reporting Platform before 11 September 2026?
Who is the named decision-owner for "does this meet the actively-exploited or severe-incident threshold"?

Not a committee. A person, on the record, who can make that call inside the first hour.
Could your team correctly classify three hypothetical scenarios as reportable or not — cold, right now?
Do you know the difference between the Article 14 reporting duty (binding now) and the Article 13 vulnerability-handling program (binding December 2027)?

This is the single most common confusion in the industry right now — and scoping the wrong one wastes budget in both directions.

The Program

Three Exercises, One Escalating Track

Each builds on the last. TTX1 is open — read the full structure below. TTX2 and TTX3 go deeper into execution and crisis, and are built for organizations ready to move past discussion.

TTX1 — "Are You Ready?"

Orientation • Governance

Audience: Compliance, legal, product security lead, one executive sponsor. ~90 minutes, discussion-based, no real-time pressure.
Goal: Surface governance and awareness gaps before they surface during a real incident.

What gets discussed in the room:

Whether you're the manufacturer of record for each in-scope product line
Whether you know your CSIRT coordinator and have (or plan to have) SRP access
Whether a named decision-owner exists for the reportability call
A cold read of three hypothetical scenarios — reportable or not?
Whether your Sept 2026 scoping is accidentally pulled toward the December 2027 Article 13 requirements, or missing them entirely where it shouldn't

It closes with a single soft inject — a one-paragraph vulnerability report from an outside researcher. The only question that matters: is this reportable, who decides, and what's the first thing that actually happens in your building?

TTX2 — "Can You Actually Do It?"

Functional • Process Test

Audience: Cross-functional — security ops, legal, comms, engineering, your SRP submitter, exec sponsor. Half-day.

One realistic scenario, played across the full lifecycle: an ambiguous signal, confirmed exploitation, the 24-hour warning drafted under real time pressure, new facts landing right at the 72-hour deadline, and the 14-day final-report clock that resets when your fix ships — not when you first noticed.

Full inject sequence and facilitator materials shared during scoping.

TTX3 — "When It's Really Going Wrong"

Crisis • Cascading

Audience: Full incident command, executives, legal, comms, possibly board-level observers. Full day, high pressure.

Everything TTX2 doesn't cover: a reporting platform outage mid-window, a shared component that puts an OEM partner's clock on the line too, a parallel GDPR or NIS2 notification running on a different timeline, and a press leak that beats your own user notification out the door.

Scenario design is built around your product, your geography, and your actual partners.