The 24-hour stage
Under the CRA reporting rules, an early warning must be submitted without undue delay and in any event within 24 hours of the manufacturer becoming aware of the relevant event. The purpose is not to complete a perfect forensic investigation in one day; it is to provide the required early information available at that stage.
What should an internal workflow capture immediately?
At minimum, teams should be able to record awareness time, the affected product, the known event summary, known exploitation or malicious activity, available mitigation information, relevant geographic scope where applicable, internal case owner and review status. Unknown information should remain explicitly unknown rather than guessed.
Why preparedness matters
Twenty-four hours is short when security, engineering, legal and executive teams are working across time zones. A pre-agreed runbook reduces the time lost deciding who owns the process after an event occurs.