Board report

Plans: Core and Plus, and the free trial. Who: every member.

The board report shows, for one calendar quarter, that your vulnerability handling works: what Pharus monitored, what it found, how the team responded, whether reports to the authorities went in on time, and what is still open. Every figure comes from what Pharus recorded, so there is nothing to fill in. It is under Reports → Board report.

Open a quarter

Open the report

Go to Reports → Board report. It opens on the last completed quarter. For a company created during the current quarter, it opens on this quarter so far.

Pick another quarter

Choose one under Quarter. The list runs from the current quarter back to the quarter the company was created in.

The current quarter is labelled “so far”, for example “Q4 2026 so far”, and the report says: “The quarter isn’t over yet. Figures run up to when this report was generated.”

The period

A quarter runs in Oslo time from 00:00 on 1 January, 1 April, 1 July or 1 October to 00:00 on the first day of the next quarter. The header shows the company, the dates, when the report was generated and “Prepared with Pharus”. A few figures don’t follow the quarter: the feed sync times, the phones on the rota and Open items and risks are as of the moment the report is generated, and the report says so.

What it contains

Section	What it shows
1. Summary	A few headline sentences, and four figures: Reports filed on time, Known exploited vulnerabilities, Incidents opened and Last drill.
2. Exposure	How many product families are covered by an SBOM, components monitored and SBOMs received, per family; when each vulnerability feed last synced. A family counts as covered when an SBOM was received in the quarter or was still current at its end.
3. Detection	New matches, exploited matches (on CISA KEV, exploited in EUVD), and name-only matches flagged and confirmed, per product family.
4. Response	Incidents opened and closed, by kind, source and close reason; determinations recorded; the median time from awareness to an approved determination; four-eyes approvals given and declined.
5. Reporting on time	The CRA Art. 14 reports due in the quarter (early warning, notification, final report): filed, on time, late, overdue and not filed, and receipts recorded, with a table of the late and overdue ones.
6. Coordinated vulnerability disclosure	Vulnerability reports received, how many were acknowledged within the business days your disclosure policy promises, late, not yet acknowledged and closed without a reply, and the median time to first response.
7. Security advisories	CSAF advisories published in the quarter, with tracking ID, title, version and date.
8. On-call readiness	Pages sent (test pages included), acknowledged, the median time to acknowledge, escalated to the next person, and not acknowledged before the chain ran out; who on the rota has no verified phone today.
9. Drills	Drills started and completed, the last one completed, and whether the annual drill is done: one completed in the last 12 months.
10. Open items and risks	As of now: open incidents and their next deadline, overdue reports to the authorities in any regime, product families without an SBOM for 30 days or more, vulnerability feeds not synced for 24 hours or more, and people on the rota without a verified phone.

On time means submitted at or before the CRA Art. 14 deadline: 24 hours and 72 hours from awareness for the early warning and the notification; for the final report, 14 days after a fix is available (actively exploited vulnerability) or one month after the notification (severe incident). A report due in the quarter but not filed by its end counts as overdue. Drills never count towards incidents, response or reporting. They appear only under Drills. See Drills.

Print or save it as PDF

Open the quarter

Open the quarter you want under Quarter.

Select Print or save as PDF. Your browser’s print dialog opens.

Save as PDF

To get a file for the board pack, choose “Save as PDF” as the destination in the print dialog.

The printout leaves out the app’s navigation and the controls, so it shows only the report. The report is in the language you use Pharus in.

On Starter, Reports → Board report shows what the plan includes instead, and nothing of the report is computed. See Plans.

Get started

Monitoring

Incidents

Coordinated disclosure

On-call and alerts

Reports and records

Workspace and account

Help

Open a quarter

The period

What it contains

Print or save it as PDF

Technical documentation

Audit trail

Reporting clocks

Drills

​Open a quarter

​The period

​What it contains

​Print or save it as PDF

​Related

Technical documentation

Audit trail

Reporting clocks

Drills

Open a quarter

The period

What it contains

Print or save it as PDF

Related