Back to the CRA kit

CRA evidence log: a small worked excerpt

Adapted from the existing CRA kit’s Evidence and Decision Log. All product, people, event and evidence references below are synthetic. This is not customer evidence, a completed assessment or a legal determination.

A scanner result starts an investigation; it does not establish what happened in your product. This excerpt shows how to keep observations separate from decisions while that investigation is still open.

#: 1

UTC timestamp: 2026-09-25 09:00

Type: SIG

Track: VULN

Event / action: A test dependency scan identifies a bundled component requiring review.

Evidence ref: DEMO-001/scan.json

Basis: Synthetic scanner observation; exploitation in this product is not established.

Person: Alex Example

Reportability position: assessing

#: 2

UTC timestamp: 2026-09-25 09:20

Type: ACT

Track: VULN

Event / action: The reviewer checks the shipped build and relevant upstream information.

Evidence ref: DEMO-001/build-review.txt

Basis: Investigation step; this row records work, not a reporting decision.

Person: Sam Example

Reportability position: assessing

#: 3

UTC timestamp: 2026-09-25 09:40

Type: REV

Track: VULN

Event / action: Evidence remains incomplete. The reviewer records unanswered questions and the next check.

Evidence ref: DEMO-001/open-questions.md

Basis: No claim of a clean result or a completed reporting assessment.

Person: Alex Example

Reportability position: assessing

The real record should identify retained source evidence, the actual people making decisions and the basis for those decisions. This example does not set an awareness timestamp or calculate a filing deadline.

The European Commission’s current reporting guidance distinguishes the early-warning and notification deadlines from the final-report deadlines. For actively exploited vulnerabilities, the final-report deadline depends on corrective or mitigating measure availability. For severe incidents, it is linked to the 72-hour notification. Check the applicable obligation and current primary guidance before filing.

The existing CRA kit contains six documents, templates and a combined PDF. The $149 single-organisation and $490 consultancy tiers use the same files with different rights. Current delivery is a manual email claim after payment verification. This excerpt does not establish payment verification, recipient delivery, legal review of the full kit or availability of a delivery slot.

Engineering and process material, not legal advice, certification or a promise of compliance. Synthetic example prepared September25, 2026; public reading edition September28, 2026. Payment verification, applicable send authority and recipient delivery remain separate checks.