ENISA — European Union Agency for Cybersecurity
ENISA (European Union Agency for Cybersecurity) is the EU’s central body for cybersecurity expertise and coordination. Under the Cyber Resilience Act, ENISA operates the single reporting platform through which manufacturers must notify actively exploited vulnerabilities and severe incidents — with an early warning within 24 hours of becoming aware — simultaneously to the CSIRT designated as coordinator and to ENISA.
Key Facts
| Detail | Information |
|---|---|
| Full name | European Union Agency for Cybersecurity |
| Former name | European Network and Information Security Agency (until 2019) |
| Established | 2004 |
| Permanent mandate | EU Cybersecurity Act (Regulation 2019/881) |
| Headquarters | Athens, Greece (operational centre in Heraklion, Crete) |
| Budget (2024) | ~€25 million |
| Staff | ~100 experts |
| Key role under CRA | Operates the single reporting platform (Article 16) |
ENISA’s Role in the CRA Ecosystem
1. Vulnerability Reporting Hub
Under the CRA, ENISA operates the single reporting platform for the EU:
| Report | Deadline | Information Required |
|---|---|---|
| Early warning (actively exploited vulnerability or severe incident) | 24 hours of becoming aware — via the platform to the coordinator CSIRT and ENISA | Member States where the product is available; for incidents, whether malicious acts are suspected |
| Vulnerability / incident notification | 72 hours of becoming aware | General information on the product, the exploit and vulnerability or incident, and corrective or mitigating measures |
| Final report | Vulnerability: 14 days after a corrective or mitigating measure is available; severe incident: one month after the 72-hour notification | Description, severity and impact; corrective measures; for incidents, likely root cause |
Critical for manufacturers: If your product is deployed across the EU and a CVE is published for one of your SBOM components, you must submit an early warning through the single reporting platform within 24 hours of becoming aware that the vulnerability is being actively exploited in your product. This requires automated vulnerability monitoring — manual tracking is insufficient at scale.
2. EU Cybersecurity Certification
ENISA develops EU-wide certification schemes under the Cybersecurity Act:
| Scheme | Status | Scope |
|---|---|---|
| EUCC (EU Common Criteria) | Adopted | ICT products evaluated under Common Criteria |
| EUCS (EU Cloud Services) | In development | Cloud service providers |
| EU5G (5G Security) | In development | 5G network equipment and components |
| CRA certification | Expected | Critical product categories under CRA |
3. Coordination & Advisory
| Function | Description |
|---|---|
| CSIRTs Network | Coordinates national Computer Security Incident Response Teams |
| EU-CyCLONe | Cyber crisis management for large-scale incidents |
| Threat landscape | Annual “ENISA Threat Landscape” report — the EU’s primary threat intelligence publication |
| Guidance | Publishes implementation guidelines for NIS2, CRA, and cybersecurity standards |
| Training | ENISA Academy — cybersecurity training for professionals and policymakers |
ENISA and the NIS2 Directive
While CRA covers product vulnerability reporting through the single reporting platform, NIS2 covers organizational incident reporting:
| Aspect | CRA → coordinator CSIRT + ENISA | NIS2 → CSIRT |
|---|---|---|
| Who reports | Product manufacturers | Essential/important entities |
| What is reported | Actively exploited vulnerabilities and severe incidents affecting product security | Cybersecurity incidents affecting the organization |
| Deadline | 24 hours (early warning) | 24 hours (initial notification) |
| What happens next | The receiving CSIRT shares the notification with other Member States’ CSIRTs via the platform | National CSIRT coordinates local response |
| Overlap | A product vulnerability that causes an organizational incident triggers both reporting obligations |
Impact on Hardware Manufacturers
For companies building connected hardware products for the EU market:
- Set up the CRA reporting process — Establish internal procedures for the 24-hour early warning, the 72-hour notification and the final report.
- Automate vulnerability monitoring — Use SBOM monitoring to match your components against the CVE database continuously.
- Designate a PSIRT — Product Security Incident Response Team is the manufacturer’s interface with the coordinator CSIRT and ENISA.
- Test the process — Conduct tabletop exercises simulating a vulnerability disclosure to validate response time.
This is exactly what our SBOM Monitoring Service automates — continuous CVE matching against your product’s SBOM with pre-formatted CRA notifications ready for submission.
Related Terms
- CRA — The regulation requiring a 24-hour early warning for actively exploited vulnerabilities, sent to the coordinator CSIRT and ENISA.
- NIS2 — The directive requiring organizational incident reporting to the national CSIRT or competent authority.
- CVE — The identifiers used to track vulnerabilities; active exploitation, not the CVE itself, triggers CRA reporting.
- SBOM — The component inventory used to match products against known vulnerabilities for CRA reporting.
Official References
- ENISA — European Union Agency for Cybersecurity — ENISA official website