CSIRT coordinator finder

When Grype, Trivy or Dependency-Track turns up something in your product that's actually being exploited, craclock works out whether you have to report it, prepares the report, and keeps the proof of when you knew and what you filed. You submit it yourself: a filing is a legal statement by you, not by a tool, so craclock hands you the finished text instead of sending it for you.

Pick the EU member state you'd report to. A CDaC is the specific national team ENISA has coordinate your case, usually based on where your company is established. If you're not sure which country applies to you, see the full selection order.

Coordinator list bundled with the eu-cra-art14 ruleset version 2026.09.1, effective 12/09/2026.

ENISA doesn't publish a named contact per coordinator: only the country and its contact link(s).

Want to know when something changes? Get the regulatory changelog by email