> ## Documentation Index > Fetch the complete documentation index at: https://docs.pharussecurity.com/llms.txt > Use this file to discover all available pages before exploring further. # Routing > How Pharus works out which CSIRT receives your CRA reports under Art. 14(7), where you set the facts it uses, and how other regimes are triaged. **Plans:** Every plan. Triage of GDPR, digitalsikkerhetsloven and NIS2 next to the CRA: Core and Plus, and the free trial. **Who:** owners and admins set the route; any member changes a regime's status on an incident. CRA reports are filed in ENISA's Single Reporting Platform (SRP), and each one reaches a coordinating CSIRT. CRA Art. 14(7) decides which. Pharus works out the CSIRT from facts you record about your company and product families, shows the route on each incident's **Routing** tab, and puts the recipient on the SRP pack, for example "NCSC-FI via SRP". ## How the route is decided 1. **Main establishment in the EU.** If your company's main establishment is in an EU member state, that state's CSIRT receives the reports for every product family. The Routing tab says "Main establishment in the EU decides the route." 2. **Otherwise, the cascade.** For a company established in Norway, Iceland, Liechtenstein or outside the EU and the EEA, Pharus walks four links in order. The first link that is in an EU member state decides: | Link | The question | | - | - | | 1. Authorised representative in the EU | Where is your authorised representative? | | 2. Importer | Where is the importer of the product? | | 3. Distributor | Where is the distributor? | | 4. Member state with most users | Where do most of the product's users sit? | In the app's words: "Under CRA Art. 14(7) the first link in the EU decides." ### Companies in Norway For a company with its main establishment in Norway, the app shows this under **Settings → Company**: > The CRA is not yet part of the EEA Agreement, so Nkom can't receive reports. You report to the CSIRT of the EU state the links below decide. Nkom is expected to take over, with 11 December 2027 as a target, not a decided date. So a Norwegian manufacturer fills in the cascade like any company outside the EU. The marketing site has a longer explanation and every member state's CSIRT: [Reporting from Norway](https://www.pharussecurity.com/en/reporting-from-norway). ## Set the route Owners and admins set the facts. Pharus asks for them when you sign up, and you can change them at any time. Under **Settings → Company**, pick **Main establishment**: an EU or EEA state, or **Outside the EU and the EEA**. If the main establishment isn't in the EU, the **Default reporting route** card shows the four links. For each, pick the EU member state, or **None**. The card shows the CSIRT the answers lead to as you go. A product family can have its own importer or distributor. Under **Settings → Product families**, open the family and set its **Reporting route**: **Inherit company route**, or its own links. A company established in the EU can't override: every family reports to the CSIRT there. The product families list shows each family's route under **Reports to**: "Company route", "Own route" or "Not settled". ## The Routing tab The **CSIRT route** card ("CRA Art. 14(7): where the early warning, notification and final report go.") shows: * A badge for the CSIRT: **Confirmed** (on ENISA's list of coordinating CSIRTs), **Proposed**, **Unverified** or **Pick a country**. * Where the route comes from: the main establishment, "Company route", or "Set for" the product family. * The cascade, link by link. The deciding link is ticked. Links before it with no answer say "None"; links after it say "Not evaluated". * The **Report to** box: the CSIRT, its authority where there is one, and "via ENISA SRP", with a note such as when the CSIRT started receiving reports. * **Edit route**, which opens **Settings → Company**, or the product family's settings when the family has its own route. If no link names an EU state, the card says **Route not settled**: "Answer the Art. 14(7) questions in Settings so Pharus knows which CSIRT receives your reports." The SRP pack then shows "Route not settled. Check the Routing tab." when you mark a report as submitted. The route is read from your settings each time the incident is shown. When you mark a report as submitted, Pharus stores the recipient with that filing, so a later change to the route doesn't change where an earlier report went. ### The Nordic EU states | Member state | Coordinating CSIRT | What the app notes | | - | - | - | | Sweden | CERT-SE · NCSC | CERT-SE is part of NCSC at FRA from 1 Jul 2026 | | Denmark | FE Cybersituationscenter · Forsvarets Efterretningstjeneste | The Danish Defence Intelligence Service's cyber situation centre handles the CSIRT task under NIS2 | | Finland | NCSC-FI · Traficom | Receiving reports since 11 Sep 2026 | For the other member states, the app uses ENISA's list of CSIRTs designated as coordinators under the CRA. ## Other regimes The same incident can trigger other reporting duties, each with its own recipient, language and deadlines. The **Regimes** card on the Routing tab ("Every regime the incident may trigger, with its own recipient and windows.") lists them with a status: | Status | Meaning | | - | - | | **Triggered** | Reportable under this regime | | **Under review** | Still being assessed | | **Not applicable** | Doesn't apply to this incident | | **Tracked** | Followed for reference. No obligation yet | A new incident starts with a default triage: the CRA under review; digitalsikkerhetsloven under review for a company established in Norway, and not applicable elsewhere; GDPR under review; NIS2 tracked in Norway ("Not yet Norwegian law.") and under review elsewhere; and DORA under review for a financial entity on a plan with DORA. To change a status, select **Change status** on the regime's row, pick the **Status** and give a **Reason** of at least 3 characters. For digitalsikkerhetsloven, GDPR and NIS2 you also set **Aware for this regime (Oslo time)** and the **Recipient**. Then select **Record assessment**. The change is added as a new assessment; earlier ones stay in the **Assessment history** ("Append-only. The latest row per regime is the current status."). * **The CRA's row** follows the determination once it is in force on Core and Plus. On Starter you set it here. Its recipient always follows the route above, and its clocks follow the incident's awareness time. * **GDPR, digitalsikkerhetsloven and NIS2** are triaged on Core and Plus, and in the free trial. A regime that is already triggered can still be worked on after a downgrade. * **DORA's row** follows the classification on the DORA tab and has no **Change status** button. A triggered Norwegian notice or DORA report gets its own clocks and paste pack on the **Notices** tab. See [Norwegian notices](/incidents/norwegian-notices) and [DORA](/incidents/dora). ## Related The pack that goes to the CSIRT this route names. Give a family its own reporting route and member states. digitalsikkerhetsloven and GDPR notices, in Norwegian. Classification and reporting for financial entities. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.