Reporting
Does Pharus file the CRA report for us?
Does Pharus file the CRA report for us?
No. ENISA’s Single Reporting Platform has no API, so reports are pasted in by hand. Pharus prepares each stage as a paste pack, filled in from the incident wherever it has the answer. You paste it into the SRP, mark the stage as submitted and record the receipt, and Pharus keeps the record.
Where does a Norwegian manufacturer send its CRA report?
Where does a Norwegian manufacturer send its CRA report?
To an EU CSIRT, through the SRP. The CRA is not yet part of the EEA Agreement, so Nkom can’t receive CRA reports. Article 14(7) decides which member state’s CSIRT coordinates your report, and Pharus shows the route on each incident. See routing and reporting from Norway.
When does the 24-hour clock start?
When does the 24-hour clock start?
When you become aware of the actively exploited vulnerability or the severe incident, not when the investigation is done. For an incident that Pharus opens from an exploited match, awareness is the time Pharus first saw the match as exploited. An owner or admin can correct it. See clocks.
We are a small company. Does the 24-hour deadline apply to us?
We are a small company. Does the 24-hour deadline apply to us?
The early warning is required from every manufacturer. Micro and small enterprises are not fined for missing the 24-hour early-warning deadline (CRA Art. 64(10)), but that exemption doesn’t cover the 72-hour notification or the final report.
Do GDPR, digitalsikkerhetsloven and DORA run on the same incident?
Do GDPR, digitalsikkerhetsloven and DORA run on the same incident?
Yes. On Core and Plus, Pharus assesses GDPR and digitalsikkerhetsloven next to the CRA, each with its own awareness time and deadlines, and drafts the Norwegian notices for Datatilsynet and NSM. DORA triage is part of Plus and an add-on on Starter and Core. See Norwegian notices and DORA.
Does Pharus give legal advice?
Does Pharus give legal advice?
No. Pharus applies the rules as the regulations write them and shows its reasoning, but the determination and the filing are yours. On Starter and Core you can ask a partner consultant to review an incident for a fee per incident; Plus includes it. See expert help.
SBOMs and monitoring
Which SBOM formats does Pharus read?
Which SBOM formats does Pharus read?
CycloneDX JSON 1.4 to 1.7 and SPDX JSON 2.2 to 2.3, up to 50 000 components. XML, tag-value and SPDX 3 files aren’t read. See SBOMs.
Do we have to replace Dependency-Track?
Do we have to replace Dependency-Track?
No. Dependency-Track can send each processed BOM to Pharus with a webhook alert, and Pharus adds the clocks, routing and records on top. See Dependency-Track.
How quickly do we hear about a new exploited vulnerability?
How quickly do we hear about a new exploited vulnerability?
Matching starts within seconds of an SBOM arriving. After that, Pharus syncs CISA KEV and EUVD every 30 minutes and re-checks every product family against them, and refreshes each component’s OSV.dev lookup every 6 hours. A new exact match on an exploited vulnerability opens an incident and, on Core and Plus, pages whoever is on call. See vulnerabilities.
What do OSV.dev and other outside services learn about us?
What do OSV.dev and other outside services learn about us?
OSV.dev receives the identifiers (purls) of your components, never your company’s name. See the data processing page for every sub-processor.
Plans and billing
How does the free trial work?
How does the free trial work?
What happens if we don't subscribe?
What happens if we don't subscribe?
The workspace moves to Free. Vulnerability reports keep arriving and you can answer them, while monitoring, the CRA clocks and SRP packs pause. Nothing is deleted, and subscribing opens everything again. A Free workspace that nobody signs in to for 12 months is deleted.
Do we pay per user?
Do we pay per user?
No. Pharus is priced per product family, so bring the whole team.
How do we get Plus, or pay by invoice?
How do we get Plus, or pay by invoice?
Plus is set up together with us. Contact us and we set up the subscription for your workspace.
Data and account
Which languages does Pharus support?
Which languages does Pharus support?
The app is in Norwegian (bokmål) and English. Companies in Sweden, Denmark and Finland use it in English. The notices for NSM and Datatilsynet are drafted in Norwegian; SRP packs and the DORA reporting template for Finanstilsynet are in English, as those forms are. This documentation is in English.
Can we take our data with us?
Can we take our data with us?
Yes. Owners and admins can download everything the company has in Pharus as one file, at any time, also when the workspace is read-only. See data and deletion.
Can one person work for several companies?
Can one person work for several companies?
Yes. One account can be a member of several workspaces, and you switch between them in the sidebar. See companies.
How do we get help?
How do we get help?
Use Contact support in the app’s sidebar, or the contact page.