Latest / Cybersecurity Under Pressure. Real Attacks, Real Lessons
What Actually Starts the CRA 24-Hour Clock? | CUP Micro Brief
Not every vulnerability starts the Cyber Resilience Act reporting clock. This CUP Micro Brief explains the two triggers, why reachability and VEX matter, and how CRA product obligations differ from NIS2 operator duties.
Related CUP episodes:
The 24-Hour Trap: Defensible Decisions Under the Cyber Resilience Act
Cyber Resilience Act: Making the 24-Hour Reporting Decision
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.