Skip to main content
Plans: Every plan. Who: any member drafts the notice and records that users were informed.
After an actively exploited vulnerability or a severe incident, the CRA asks you to inform the impacted users, and where appropriate all users, and to tell them what they can do to limit the impact (CRA Art. 14(8)). If you don’t do it in time, the CSIRT may tell them itself. Pharus drafts the notice from the incident and keeps the record. You send it through your own channels.

​
When the Users tab appears

The incident gets a Users tab, and its Overview tab an Inform users card, once the duty applies:
  • the latest determination, unless it was declined, says the vulnerability is actively exploited or the incident is severe;
  • a CRA early warning or notification is marked as submitted; or
  • the incident is an exploited vulnerability that nobody has ruled out yet: no determination says it isn’t exploited or doesn’t affect you, and it wasn’t closed as not reportable.
The tab also stays once something has been recorded. Drills never get it. The Inform users card shows Not recorded yet or Users informed with the date. Once the CRA notification is submitted and users still aren’t recorded as informed, the card turns into a warning: “The notification is submitted, but users haven’t been recorded as informed yet.”

​
Draft the notice

1

Open the Users tab

On the incident, select Write the notice on the Inform users card, or open the Users tab. The notice is prefilled from the incident, the SRP pack and its advisories.
2

Choose the language and the audience

Pick the Language, Norwegian or English; it starts in the company’s default language. Under Who to tell, choose The impacted users or All users. A draft you haven’t edited follows the language you pick.
3

Edit the text

Check the Subject, What happened and What users can do: updates to install, settings to change, workarounds. Pharus fills What users can do from the SRP pack’s field 3.2 or the remediations in the incident’s advisories; the SRP pack’s field 3.2 in turn uses this text when it has none of its own.
4

Save the draft

Select Save draft. Start over from the template replaces your text with Pharus’s first draft again.
The whole message shows the notice as it will read. Pharus adds at the end the links to the incident’s public advisories and their CSAF documents, your security contact and the company name. The security contact is the contact address in your disclosure settings (Settings → Disclosure), else the security contact email under Settings → Company.

​
Send it through your own channels

Pharus sends nothing. Copy The whole message with its copy button, or select Open in email: your email program opens with the subject and the text and no recipients. Add your customers there, as Bcc. Pharus sends no bulk email and keeps no list of your customers or their addresses. Pharus doesn’t publish the notice either. What it links to is public: the incident’s advisories, once you publish them on your disclosure page at /disclose/<your-slug>/advisories and in your CSAF feed. See advisories. Publish the advisory first if you want the notice to link to it.

​
Record that users were informed

1

Record users informed

When you have told users, select Record users informed.
2

Say when and how

Set Users informed at and tick under How every channel you used: Email, Security advisory, Website, In the product or Other. The time can’t be in the future.
3

Save the record

Select Record. Pharus keeps the message as it reads now, with when and how users were told.
The record can’t be changed afterwards. Check the message and the time before you select Record.
Each record is listed under Recorded on the Users tab, with “Recorded by” the person and the time, and Show the message shows what users were told. You can record more than once, for example a first notice to the impacted users and a later one to all users. Each record lands in the audit trail.

​
Closing the incident

An owner or admin can close an incident before users are recorded as informed. The close dialog warns: “Users haven’t been recorded as informed (CRA Art. 14(8)). You can still close the incident.”

​
End-of-support notices

Users should also know when their product stops getting security updates. That notice is drafted and recorded from a product family’s support periods, with Tell users, not from an incident. See support periods.

Advisories

Publish the CSAF/VEX advisory your notice links to.

SRP paste pack

Field 3.2 and the CRA notification.

Support periods

End dates per release line, and telling users.

Incidents

How an incident runs from match to closing.