Conscious @ConsciousGRC

Under the EU Cyber Resilience Act, which reporting clock would your team find hardest to meet?

@NIST Thank you. The dated schedule is what makes this usable outside government: deprecated after 2030, disallowed after 2035. For most organisations the first activity is the inventory, including the RSA and elliptic-curve keys inside vendor products.

@TheHackersNews Useful detail that the movement stayed inside policy-permitted paths. A good prompt to review which devices each access policy lets reach a server, not only who can log in. Is there guidance yet for Headscale users while a fix is pending?

@CISAgov Thanks for sharing. For organisations outside the federal space, the Harden work is most useful when it arrives as concrete baselines, as the KEV catalogue and the SCuBA configurations already do. Looking forward to reading the strategy in full.

@TheHackersNews Thanks for the update. For anyone tracking it in CISA's KEV catalogue, CVE-2026-111497 is listed under Google Brotli, added 27 October with a federal due date of 10 November. Worth checking vendor products that bundle Node.js, not only your own servers.

@NCSC Useful timing, with CISA's federal deadline for the two PHP flaws falling tomorrow. The harder part of a patch wave is often PHP running inside vendor products, where the fix date belongs to the supplier. Does the guidance cover asking suppliers for theirs?

A UK inspection report published on Tuesday found most police supplier contracts had no ongoing cybersecurity assurance. Some staff could not say if suppliers had to report incidents promptly. Worth checking in any contract: ongoing assurance, a reporting deadline, log access.

All of it goes through ENISA's Single Reporting Platform, and the clock starts when you become aware, not when the paperwork is ready. Which of your products and entities does it reach? Free mapping: consciousgrc.com/assess/?utm_so…

2. Notification: within 72 hours, with what you know so far. 3. Final report: within 14 days of a fix being available. Severe incidents follow the same first two clocks, with a final report within a month.

If you make or import software or connected hardware sold in the EU, three reporting clocks have been running since 11 September 2026. Here they are, in order.