Article 14 imposes a layered reporting regime channelled through the Article 16 single reporting platform operated by ENISA and CSIRTs: (1) 24-hour early warning to ENISA and to the CSIRT designated as the coordinator notifying of an actively exploited vulnerability or severe incident; (2) 72-hour notification update; (3) Final report within 14 days (or one month for severe incidents). Article 14(8) requires the manufacturer to notify users without undue delay of any actively exploited vulnerability and any severe incident impacting the security of the PDE, including instructions on corrective measures available to users. Article 14(10)-(11) provides for voluntary notification of other vulnerabilities and incidents, with protection of reporting persons.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.