Skip to main content
Plans: Every plan. Triage of GDPR, digitalsikkerhetsloven and NIS2 next to the CRA: Core and Plus, and the free trial. Who: owners and admins set the route; any member changes a regime’s status on an incident.
CRA reports are filed in ENISA’s Single Reporting Platform (SRP), and each one reaches a coordinating CSIRT. CRA Art. 14(7) decides which. Pharus works out the CSIRT from facts you record about your company and product families, shows the route on each incident’s Routing tab, and puts the recipient on the SRP pack, for example “NCSC-FI via SRP”.

​
How the route is decided

  1. Main establishment in the EU. If your company’s main establishment is in an EU member state, that state’s CSIRT receives the reports for every product family. The Routing tab says “Main establishment in the EU decides the route.”
  2. Otherwise, the cascade. For a company established in Norway, Iceland, Liechtenstein or outside the EU and the EEA, Pharus walks four links in order. The first link that is in an EU member state decides:
In the app’s words: “Under CRA Art. 14(7) the first link in the EU decides.”

​
Companies in Norway

For a company with its main establishment in Norway, the app shows this under Settings → Company:
The CRA is not yet part of the EEA Agreement, so Nkom can’t receive reports. You report to the CSIRT of the EU state the links below decide. Nkom is expected to take over, with 11 December 2027 as a target, not a decided date.
So a Norwegian manufacturer fills in the cascade like any company outside the EU. The marketing site has a longer explanation and every member state’s CSIRT: Reporting from Norway.

​
Set the route

Owners and admins set the facts. Pharus asks for them when you sign up, and you can change them at any time.
1

Set the main establishment

Under Settings → Company, pick Main establishment: an EU or EEA state, or Outside the EU and the EEA.
2

Answer the cascade

If the main establishment isn’t in the EU, the Default reporting route card shows the four links. For each, pick the EU member state, or None. The card shows the CSIRT the answers lead to as you go.
3

Override for a product family, if needed

A product family can have its own importer or distributor. Under Settings → Product families, open the family and set its Reporting route: Inherit company route, or its own links. A company established in the EU can’t override: every family reports to the CSIRT there.
The product families list shows each family’s route under Reports to: “Company route”, “Own route” or “Not settled”.

​
The Routing tab

The CSIRT route card (“CRA Art. 14(7): where the early warning, notification and final report go.”) shows:
  • A badge for the CSIRT: Confirmed (on ENISA’s list of coordinating CSIRTs), Proposed, Unverified or Pick a country.
  • Where the route comes from: the main establishment, “Company route”, or “Set for” the product family.
  • The cascade, link by link. The deciding link is ticked. Links before it with no answer say “None”; links after it say “Not evaluated”.
  • The Report to box: the CSIRT, its authority where there is one, and “via ENISA SRP”, with a note such as when the CSIRT started receiving reports.
  • Edit route, which opens Settings → Company, or the product family’s settings when the family has its own route.
If no link names an EU state, the card says Route not settled: “Answer the Art. 14(7) questions in Settings so Pharus knows which CSIRT receives your reports.” The SRP pack then shows “Route not settled. Check the Routing tab.” when you mark a report as submitted.
The route is read from your settings each time the incident is shown. When you mark a report as submitted, Pharus stores the recipient with that filing, so a later change to the route doesn’t change where an earlier report went.

​
The Nordic EU states

For the other member states, the app uses ENISA’s list of CSIRTs designated as coordinators under the CRA.

​
Other regimes

The same incident can trigger other reporting duties, each with its own recipient, language and deadlines. The Regimes card on the Routing tab (“Every regime the incident may trigger, with its own recipient and windows.”) lists them with a status: A new incident starts with a default triage: the CRA under review; digitalsikkerhetsloven under review for a company established in Norway, and not applicable elsewhere; GDPR under review; NIS2 tracked in Norway (“Not yet Norwegian law.”) and under review elsewhere; and DORA under review for a financial entity on a plan with DORA. To change a status, select Change status on the regime’s row, pick the Status and give a Reason of at least 3 characters. For digitalsikkerhetsloven, GDPR and NIS2 you also set Aware for this regime (Oslo time) and the Recipient. Then select Record assessment. The change is added as a new assessment; earlier ones stay in the Assessment history (“Append-only. The latest row per regime is the current status.”).
  • The CRA’s row follows the determination once it is in force on Core and Plus. On Starter you set it here. Its recipient always follows the route above, and its clocks follow the incident’s awareness time.
  • GDPR, digitalsikkerhetsloven and NIS2 are triaged on Core and Plus, and in the free trial. A regime that is already triggered can still be worked on after a downgrade.
  • DORA’s row follows the classification on the DORA tab and has no Change status button.
A triggered Norwegian notice or DORA report gets its own clocks and paste pack on the Notices tab. See Norwegian notices and DORA.

SRP paste pack

The pack that goes to the CSIRT this route names.

Product families

Give a family its own reporting route and member states.

Norwegian notices

digitalsikkerhetsloven and GDPR notices, in Norwegian.

DORA

Classification and reporting for financial entities.