craclock

What is a CDaC and how is mine chosen?

A CDaC ("CSIRT Designated as Coordinator") is just the specific national cybersecurity team you have to send your Article 14 reports to, out of all the teams across the EU. Which one is yours isn't a choice: it's picked by an ordered test, first by where your company is mainly based, then by employee count, and if you have no EU base at all, by your representative, importer, distributor or user count, in that order.

Which national team is yours, in order:

  1. Main base: the Member State where cybersecurity decisions are mainly made.
  2. Employee count: if that's unclear, wherever you have the most employees in the EU.
  3. Representative: if you have no EU base at all, wherever your representative handles the most products.
  4. Importer: if that doesn't apply, wherever your biggest importer operates.
  5. Distributor: if that doesn't apply, wherever your biggest distributor operates.
  6. Users: if none of the above applies, wherever you have the most users.
Look up your country's CDaC contact details

When Grype, Trivy or Dependency-Track turns up something in your product that's actually being exploited, craclock works out whether you have to report it, prepares the report, and keeps the proof of when you knew and what you filed. You submit it yourself: a filing is a legal statement by you, not by a tool, so craclock hands you the finished text instead of sending it for you.

The reasoning, in full.

What CDaC means

It’s not a support inbox you pick; it’s assigned to you by a fixed set of rules. CDaC stands for “CSIRT Designated as Coordinator.” The acronym and its expansion appear in ENISA’s own SRP FAQ, which states that manufacturers, and, once applicable, open-source software stewards, “are responsible for identifying the correct CSIRT designated as coordinator (CDaC).” A CDaC is the specific national CSIRT that receives a manufacturer’s Article 14 notifications, early warning, 72-hour notification, final report, and is simultaneously accessible to ENISA.

Unsettled: neither ENISA page gives “CDaC” its own glossary entry; both just spell it out in running text. The definition and the order both come from Article 14(7) itself, not a defined-terms list, but they agree.

Where the selection rule comes from

The rule is set out in Article 14(7) of Regulation (EU) 2024/2847 itself, and ENISA’s SRP FAQ restates it in plain language for manufacturers filling in the platform. Both texts agree, and the FAQ is explicit that it is describing the Article 14(7) test.

The selection order

Confirmed against EUR-Lex’s official text of Article 14(7) and against the ENISA SRP FAQ’s own wording, the order is:

  1. The Member State of your main establishment in the Union, defined as “the Member State where the decisions related to the cybersecurity of its products with digital elements are predominantly taken.”
  2. If that Member State cannot be determined, “the main establishment shall be considered to be in the Member State where the manufacturer concerned has the establishment with the highest number of employees in the Union.”
  3. If you have no main establishment in the Union at all, the order then runs: “the Member State in which the authorised representative acting on behalf of the manufacturer for the highest number of products with digital elements of that manufacturer is established.”
  4. If that does not apply, “the Member State in which the importer placing on the market the highest number of products with digital elements of that manufacturer is established.”
  5. If that does not apply, “the Member State in which the distributor making available on the market the highest number of products with digital elements of that manufacturer is established.”
  6. If none of the above applies, “the Member State in which the highest number of users of products with digital elements of that manufacturer are located.”

Article 14(7) adds one operational note for the last branch: once a manufacturer has reported to a CDaC on the “highest number of users” basis, “a manufacturer may submit notifications related to any subsequent actively exploited vulnerability or severe incident having an impact on the security of the product with digital elements to the same CSIRT designated as coordinator to which it first reported.”

Practical effect

The CRA SRP platform is where you actually select the CDaC when submitting a notification, and ENISA’s FAQ warns that selecting the wrong one invalidates the notification, which then has to be resubmitted to the correct CDaC. craclock’s own CSIRT coordinator finder tool does not implement this ordered test itself: it is a per-country contact directory, you pick a Member State and it returns that country’s coordinator name and reporting-contact links, and the tool’s own on-page copy tells you to work out the applicable Member State against the Article 14(7) order first, before using it. In practice, that means applying the six-step test above yourself to find which Member State’s CDaC applies to you, then using the site’s lookup tool to get that country’s contact details.

Sources

Get the regulatory changelog by email

We watch ENISA's guidance pages for changes that could affect your filing, and email you when one happens. That means it may be quiet for weeks: the first email won't go out until there's something worth sending.