# CRA Flow
## Elements
| Element | Meaning |
|---|---|
| Solid arrow between lanes | A message one party sends another |
| Dashed arrow | A response, or an optional message |
| Arrow looping back on a lane | That party's own internal task |
| Vertical bar on a lane | That party is busy with its own work |
| Coloured band | Phase of the flow |
| Yellow note | A caveat or rule, not an action |
| `break` block | The flow stops there, nothing below it runs |
## Parties
| Lane | Party |
|---|---|
| `R` | Reporter |
| `A` | ADLINK PSIRT |
| `M` | MITRE / CNA |
| `S` | Supplier PSIRT |
| `C` | National CSIRT |
| `E` | ENISA |
| `U` | Affected users |
## Scenario A: customer or researcher reports via PSIRT
```mermaid
%%{init: {'theme': 'default'}}%%
%% Standing prerequisite, not a step: security.txt at /.well-known/ as the public contact point (Art. 13(17), RFC 9116, BSI TR-03183-3 §4.2)
sequenceDiagram
autonumber
actor R as Reporter
participant A as ADLINK PSIRT
participant M as MITRE / CNA
participant S as Supplier PSIRT
participant C as National CSIRT
participant E as ENISA
actor U as Affected users
rect rgb(238, 244, 255)
Note over A: INTAKE
R->>A: Vulnerability report to psirt@adlinktech.com (Art. 13(17))
A-->>R: Acknowledge within 5 working days (BSI TR-03183-3 §4.4.8)
A-->>R: Detailed feedback within 10 working days (§4.4.8)
Note over A: A report may instead arrive through a CSIRT or ENISA, which then informs the
manufacturer (Art. 15(4)). Anonymous reporting must be possible (§4.4.9)
end
rect rgb(255, 249, 235)
Note over A: TRIAGE AND SEVERITY
activate A
A->>A: Check the SBOM: is a shipped product still within its support period affected? (Art. 13(8))
A->>A: Legacy check: placed on the market before 11 Dec 2027 and not substantially modified since? (Art. 69(2))
Note over A: Legacy products keep the Art. 14 reporting duty even where the Annex I Part II handling duties do not apply (Art. 69(3))
break no affected product is within its support period
A->>A: Log the closure and stop here. Art. 14(1) only bites when a placed-on-market product is actually affected
end
A->>A: Assign severity: CVSS v3.1 base score plus context modifiers, P1 / P2 / P3
Note over A: Patch SLAs: P1 7 d, P2 30 d, P3 next release within 90 d
deactivate A
end
rect rgb(238, 248, 240)
Note over A: ROOT CAUSE AND ESCALATION
A->>A: Root cause: own product layer or upstream supplier component?
A->>M: Request a CVE ID if none exists
A->>S: Report the component vulnerability under NDA and share any fix code (Art. 13(6))
Note over A: ADLINK stays responsible for the product including its components
(Art. 13(8)), and exercises due diligence on components (Art. 13(5))
end
alt Actively exploited (Art. 14(1))
A->>A: Confirm active exploitation: reliable evidence of exploitation without the owner's permission (Art. 3(42))
A->>C: Early warning within 24 h (Art. 14(2)(a))
A->>E: Same notification, simultaneously, via the single reporting platform (Art. 14(7))
A->>C: Full notification within 72 h (Art. 14(2)(b))
A->>U: Interim mitigations, without waiting for the patch (Art. 14(8))
C-->>A: May request intermediate status reports (Art. 14(6))
Note over A: If it is also a severe incident: same 24 h and 72 h cadence, but the final report
is due within one month of the 72 h notification (Art. 14(3), Art. 14(4)(c))
A->>C: Final report within 14 d of a fix being available (Art. 14(2)(c))
else Not actively exploited
Note over A: Hold disclosure under the embargo agreed with the reporter. Publish within 90 days (§4.4.10)
A-->>C: Optional voluntary notification (Art. 15)
end
rect rgb(255, 244, 238)
Note over A: FIX
activate A
A->>A: Produce the signed update artifact
A->>A: Validation gate: smoke test, security regression, build reproducibility
A->>A: Update the SBOM (Annex I Part II (1))
deactivate A
end
rect rgb(245, 240, 255)
Note over A: PUBLISH
A-->>U: Optional pre-notification of the patch under NDA (Annex I Part II (4))
A->>U: Security advisory, plus a free security update distributed securely
(Annex I Part II (4), Annex I Part II (7), Annex I Part II (8))
A->>E: Disclose on the EUVD on request (§4.4.10)
end
rect rgb(242, 242, 242)
Note over A: CLOSE
activate A
A->>A: Retain the technical documentation and the EU declaration of
conformity for at least 10 years or the support period (Art. 13(13))
A->>A: Schedule the post-incident review
A-->>R: CVD process complete, credit the reporter with consent (§4.4.11)
deactivate A
end
```
## Scenario B: discovered internally
```mermaid
%%{init: {'theme': 'default'}}%%
%% Standing prerequisite, not a step: security.txt at /.well-known/ as the public contact point (Art. 13(17), RFC 9116, BSI TR-03183-3 §4.2)
sequenceDiagram
autonumber
participant A as ADLINK PSIRT
participant M as MITRE / CNA
participant S as Supplier PSIRT
participant C as National CSIRT
participant E as ENISA
actor U as Affected users
rect rgb(238, 244, 255)
Note over A: INTAKE
A->>A: Found internally. ADLINK owns the timeline and the disclosure date
end
rect rgb(255, 249, 235)
Note over A: TRIAGE AND SEVERITY
activate A
A->>A: Check the SBOM: is a shipped product still within its support period affected? (Art. 13(8))
A->>A: Legacy check: placed on the market before 11 Dec 2027 and not substantially modified since? (Art. 69(2))
Note over A: Legacy products keep the Art. 14 reporting duty even where the Annex I Part II handling duties do not apply (Art. 69(3))
break no affected product is within its support period
A->>A: Log the closure and stop here. Art. 14(1) only bites when a placed-on-market product is actually affected
end
A->>A: Assign severity: CVSS v3.1 base score plus context modifiers, P1 / P2 / P3
Note over A: Patch SLAs: P1 7 d, P2 30 d, P3 next release within 90 d
deactivate A
end
rect rgb(238, 248, 240)
Note over A: ROOT CAUSE AND ESCALATION
A->>A: Root cause: own product layer or upstream supplier component?
A->>M: Request a CVE ID if none exists
A->>S: Report the component vulnerability under NDA and share any fix code (Art. 13(6))
Note over A: ADLINK stays responsible for the product including its components
(Art. 13(8)), and exercises due diligence on components (Art. 13(5))
end
alt Actively exploited (Art. 14(1))
A->>A: Confirm active exploitation: reliable evidence of exploitation without the owner's permission (Art. 3(42))
A->>C: Early warning within 24 h (Art. 14(2)(a))
A->>E: Same notification, simultaneously, via the single reporting platform (Art. 14(7))
A->>C: Full notification within 72 h (Art. 14(2)(b))
A->>U: Interim mitigations, without waiting for the patch (Art. 14(8))
C-->>A: May request intermediate status reports (Art. 14(6))
Note over A: If it is also a severe incident: same 24 h and 72 h cadence, but the final report
is due within one month of the 72 h notification (Art. 14(3), Art. 14(4)(c))
A->>C: Final report within 14 d of a fix being available (Art. 14(2)(c))
else Not actively exploited
Note over A: ADLINK sets the coordinated disclosure date. Publish within 90 days (§4.4.10)
A-->>C: Optional voluntary notification (Art. 15)
end
rect rgb(255, 244, 238)
Note over A: FIX
activate A
A->>A: Produce the signed update artifact
A->>A: Validation gate: smoke test, security regression, build reproducibility
A->>A: Update the SBOM (Annex I Part II (1))
deactivate A
end
rect rgb(245, 240, 255)
Note over A: PUBLISH
A-->>U: Optional pre-notification of the patch under NDA (Annex I Part II (4))
A->>U: Security advisory, plus a free security update distributed securely
(Annex I Part II (4), Annex I Part II (7), Annex I Part II (8))
A->>E: Disclose on the EUVD on request (§4.4.10)
end
rect rgb(242, 242, 242)
Note over A: CLOSE
activate A
A->>A: Retain the technical documentation and the EU declaration of
conformity for at least 10 years or the support period (Art. 13(13))
A->>A: Schedule the post-incident review
deactivate A
end
```
## Scenario C: supplier publishes a CVE
```mermaid
%%{init: {'theme': 'default'}}%%
%% Standing prerequisite, not a step: security.txt at /.well-known/ as the public contact point (Art. 13(17), RFC 9116, BSI TR-03183-3 §4.2)
sequenceDiagram
autonumber
participant A as ADLINK PSIRT
participant S as Supplier PSIRT
participant C as National CSIRT
participant E as ENISA
actor U as Affected users
rect rgb(238, 244, 255)
Note over A: INTAKE
S->>A: Publishes a CVE. Already public, so no confidentiality hold (Annex I Part II (2))
end
rect rgb(255, 249, 235)
Note over A: TRIAGE AND SEVERITY
activate A
A->>A: Check the SBOM: is a shipped product still within its support period affected? (Art. 13(8))
A->>A: Legacy check: placed on the market before 11 Dec 2027 and not substantially modified since? (Art. 69(2))
Note over A: Legacy products keep the Art. 14 reporting duty even where the Annex I Part II handling duties do not apply (Art. 69(3))
break no affected product is within its support period
A->>A: Log the closure and stop here. Art. 14(1) only bites when a placed-on-market product is actually affected
end
A->>A: Assign severity: CVSS v3.1 base score plus context modifiers, P1 / P2 / P3
Note over A: Patch SLAs: P1 7 d, P2 30 d, P3 next release within 90 d
deactivate A
end
rect rgb(238, 248, 240)
Note over A: ROOT CAUSE AND ESCALATION
A->>A: Root cause: own product layer or upstream supplier component?
A->>S: Integrate or backport the supplier fix, and report anything new we find (Art. 13(6))
A->>A: Production check: stop shipping affected units, corrective measures
up to withdrawal or recall (Annex I Part I (2)(a), Art. 13(21))
Note over A: ADLINK stays responsible for the product including its components
(Art. 13(8)), and exercises due diligence on components (Art. 13(5))
end
alt Actively exploited (Art. 14(1))
A->>A: Confirm active exploitation: reliable evidence of exploitation without the owner's permission (Art. 3(42))
A->>C: Early warning within 24 h (Art. 14(2)(a))
A->>E: Same notification, simultaneously, via the single reporting platform (Art. 14(7))
A->>C: Full notification within 72 h (Art. 14(2)(b))
A->>U: Interim mitigations, without waiting for the patch (Art. 14(8))
C-->>A: May request intermediate status reports (Art. 14(6))
Note over A: If it is also a severe incident: same 24 h and 72 h cadence, but the final report
is due within one month of the 72 h notification (Art. 14(3), Art. 14(4)(c))
A->>C: Final report within 14 d of a fix being available (Art. 14(2)(c))
else Not actively exploited
Note over A: Already public, so publish mitigations and fix status without delay (Annex I Part II (2))
A-->>C: Optional voluntary notification (Art. 15)
end
rect rgb(255, 244, 238)
Note over A: FIX
activate A
A->>A: Produce the signed update artifact
A->>A: Validation gate: smoke test, security regression, build reproducibility
A->>A: Update the SBOM (Annex I Part II (1))
deactivate A
end
rect rgb(245, 240, 255)
Note over A: PUBLISH
A-->>U: Optional pre-notification of the patch under NDA (Annex I Part II (4))
A->>U: Security advisory, plus a free security update distributed securely
(Annex I Part II (4), Annex I Part II (7), Annex I Part II (8))
A->>E: Disclose on the EUVD on request (§4.4.10)
end
rect rgb(242, 242, 242)
Note over A: CLOSE
activate A
A->>A: Retain the technical documentation and the EU declaration of
conformity for at least 10 years or the support period (Art. 13(13))
A->>A: Schedule the post-incident review
deactivate A
end
```
## Scenario D: supplier pre-notifies under embargo
```mermaid
%%{init: {'theme': 'default'}}%%
%% Standing prerequisite, not a step: security.txt at /.well-known/ as the public contact point (Art. 13(17), RFC 9116, BSI TR-03183-3 §4.2)
sequenceDiagram
autonumber
participant A as ADLINK PSIRT
participant S as Supplier PSIRT
participant C as National CSIRT
participant E as ENISA
actor U as Affected users
rect rgb(238, 244, 255)
Note over A: INTAKE
S->>A: Pre-notifies under embargo, with the coordinated disclosure date
end
rect rgb(255, 249, 235)
Note over A: TRIAGE AND SEVERITY
activate A
A->>A: Check the SBOM: is a shipped product still within its support period affected? (Art. 13(8))
A->>A: Legacy check: placed on the market before 11 Dec 2027 and not substantially modified since? (Art. 69(2))
Note over A: Legacy products keep the Art. 14 reporting duty even where the Annex I Part II handling duties do not apply (Art. 69(3))
break no affected product is within its support period
A->>A: Log the closure and stop here. Art. 14(1) only bites when a placed-on-market product is actually affected
end
A->>A: Assign severity: CVSS v3.1 base score plus context modifiers, P1 / P2 / P3
Note over A: Patch SLAs: P1 7 d, P2 30 d, P3 next release within 90 d
deactivate A
end
rect rgb(238, 248, 240)
Note over A: ROOT CAUSE AND ESCALATION
A->>A: Root cause: own product layer or upstream supplier component?
A->>S: Prepare the integrated fix for the supplier's disclosure date (Art. 13(6))
Note over A: ADLINK stays responsible for the product including its components
(Art. 13(8)), and exercises due diligence on components (Art. 13(5))
end
alt Actively exploited (Art. 14(1))
A->>A: Confirm active exploitation: reliable evidence of exploitation without the owner's permission (Art. 3(42))
A->>C: Early warning within 24 h (Art. 14(2)(a))
A->>E: Same notification, simultaneously, via the single reporting platform (Art. 14(7))
A->>C: Full notification within 72 h (Art. 14(2)(b))
A->>U: Interim mitigations, without waiting for the patch (Art. 14(8))
C-->>A: May request intermediate status reports (Art. 14(6))
Note over A: If it is also a severe incident: same 24 h and 72 h cadence, but the final report
is due within one month of the 72 h notification (Art. 14(3), Art. 14(4)(c))
Note over A: The supplier embargo does not suspend this. The clock runs from when ADLINK became aware (Recital 69, Art. 16(2))
A->>C: Final report within 14 d of a fix being available (Art. 14(2)(c))
else Not actively exploited
Note over A: Hold until the supplier's coordinated disclosure date
A-->>C: Optional voluntary notification (Art. 15)
end
rect rgb(255, 244, 238)
Note over A: FIX
activate A
A->>A: Produce the signed update artifact
A->>A: Validation gate: smoke test, security regression, build reproducibility
A->>A: Update the SBOM (Annex I Part II (1))
deactivate A
end
rect rgb(245, 240, 255)
Note over A: PUBLISH
A-->>U: Optional pre-notification of the patch under NDA (Annex I Part II (4))
A->>U: Security advisory, plus a free security update distributed securely
(Annex I Part II (4), Annex I Part II (7), Annex I Part II (8))
A->>E: Disclose on the EUVD on request (§4.4.10)
end
rect rgb(242, 242, 242)
Note over A: CLOSE
activate A
A->>A: Retain the technical documentation and the EU declaration of
conformity for at least 10 years or the support period (Art. 13(13))
A->>A: Schedule the post-incident review
deactivate A
end
```