Cyber Resilience Act Turns Vulnerability Disclosure into Operating Infrastructure

ENISA's CRA Single Reporting Platform, launched September 11, operationalizes 24-hour initial, 72-hour follow-up, and final reporting for actively exploited vulnerabilities, including products already on the market. CISA's shift away from a routine weekly bulletin reinforces the broader move toward evidence-based prioritization, making disclosure workflows, SBOMs, exposure telemetry, and remediation automation strategic infrastructure.