{"id":70523,"date":"2026-09-10T10:13:40","date_gmt":"2026-09-10T08:13:40","guid":{"rendered":"https:\/\/swissgrc.com\/ar\/24-hour-deadline-cyber-resilience-act-operational-preparation-2\/"},"modified":"2026-09-17T14:38:55","modified_gmt":"2026-09-17T12:38:55","slug":"what-companies-should-prepare-organizationally-now","status":"publish","type":"post","link":"https:\/\/swissgrc.com\/ar\/what-companies-should-prepare-organizationally-now\/","title":{"rendered":"Cyber Resilience Act: What Companies Should Prepare Organizationally Now"},"content":{"rendered":"<div id=\"sgce-a\" class=\"sgce-article\">\n<p class=\"rc-lede\">The reporting obligation under Article 14 of the Cyber Resilience Act has applied since 11 September 2026 and requires an initial notification within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident. Meeting this deadline requires the necessary internal structure to be in place long before the first incident occurs. What matters is not the status of the external reporting platform, but the internal chain from detection to the decision on who reports.<\/p>\n<div class=\"rc-tldr\">\n<div class=\"rc-tldr-label\">In short<\/div>\n<p>The reporting obligation of the Cyber Resilience Act has applied since 11 September 2026 and requires an initial notification within 24 hours of becoming aware of an incident. To meet this deadline, companies must know the competent CSIRT and have an internal escalation chain from detection to reporting decision in place beforehand, regardless of the status of the ENISA reporting platform.<\/p>\n<\/div>\n<nav class=\"rc-toc\" aria-label=\"Contents\">\n<div class=\"rc-toc-label\">Contents<\/div>\n<ol>\n<li><a href=\"#a1-what-the-reporting-obligation-requires-f\">What the reporting obligation requires from 11 September 2026<\/a><\/li>\n<li><a href=\"#a2-why-the-deadline-applies-earlier-than-th\">Why the deadline applies earlier than the ability to meet it<\/a><\/li>\n<li><a href=\"#a3-was-the-single-reporting-platform-ready-\">Was the Single Reporting Platform ready in time?<\/a><\/li>\n<li><a href=\"#a4-which-internal-responsibilities-must-be-\">Which internal responsibilities must be in place before the first notification<\/a><\/li>\n<li><a href=\"#a5-what-this-means-for-swiss-manufacturers-\">What this means for Swiss manufacturers with EU market exposure<\/a><\/li>\n<\/ol>\n<\/nav>\n<div class=\"rc-figures\">\n<div class=\"rc-figure-cell\">\n<div class=\"rc-figure-value\" data-to=\"24\">24<span class=\"unit\">hrs<\/span><\/div>\n<div class=\"rc-figure-label\">Deadline for the early warning notification from becoming aware of an incident<\/div>\n<div class=\"rc-figure-src\">Cyber Resilience Act, Article 14<\/div>\n<\/div>\n<div class=\"rc-figure-cell\">\n<div class=\"rc-figure-value\" data-to=\"72\">72<span class=\"unit\">hrs<\/span><\/div>\n<div class=\"rc-figure-label\">Deadline for the full notification<\/div>\n<div class=\"rc-figure-src\">European Commission, CRA Reporting, 31 July 2026<\/div>\n<\/div>\n<div class=\"rc-figure-cell\">\n<div class=\"rc-figure-value\" data-to=\"14\">14<span class=\"unit\">days<\/span><\/div>\n<div class=\"rc-figure-label\">Deadline for the final report after a corrective measure becomes available<\/div>\n<div class=\"rc-figure-src\">Element, CRA Article 14 Reporting Obligations Guide, 1 July 2026<\/div>\n<\/div>\n<\/div>\n<h2 id=\"a1-what-the-reporting-obligation-requires-f\">What the reporting obligation requires from 11 September 2026<\/h2>\n<p>Manufacturers must report an actively exploited vulnerability or a severe security incident in three steps: an early warning within 24 hours, a full notification within 72 hours, and a final report no later than 14 days after a corrective measure becomes available.<\/p>\n<p>Article 14 of the Cyber Resilience Act requires the first notification without undue delay and in any case within 24 hours of becoming aware of it.<\/p>\n<p>The final report must describe the vulnerability, name any malicious actors involved where applicable, and set out the remediation and possible mitigating measures. For severe incidents unrelated to a vulnerability, the deadline for the final report is one month instead of 14 days.<\/p>\n<h2 id=\"a2-why-the-deadline-applies-earlier-than-th\">Why the deadline applies earlier than the ability to meet it<\/h2>\n<p>The general manufacturer obligations under Article 13, including technical documentation and conformity assessment, formally apply only from 11 December 2027, while the reporting obligation under Article 14 already came into force 15 months earlier.<\/p>\n<p>This gap means that the process for detecting active exploitation, which is actually part of the Article 13 obligations, must already function even though it is not formally required until later. Companies relying on the later deadline risk a reporting gap that is not caused by the absence of a legal obligation, but by the absence of detection capability.<\/p>\n<p>The catch-up work on reporting obligations and the software bill of materials concerns exactly this gap between the reporting obligation and the documentation obligation.<\/p>\n<h2 id=\"a3-was-the-single-reporting-platform-ready-\">Was the Single Reporting Platform ready in time?<\/h2>\n<p>Ten days before the deadline, on 1 September 2026, the Single Reporting Platform built by ENISA still had no published URL on the public internet, even though it was meant to go live together with the reporting obligation on 11 September 2026.<\/p>\n<p>According to ENISA, the platform also offers no programming interface at launch, meaning every mandatory notification must go through the web portal. In addition, the list of national CSIRT designated as coordinators remained unsettled for a long time, which collided with the registration process that requires selecting a competent CSIRT from that list.<\/p>\n<p>Under Implementing Regulation (EU) 2026\/881, issued on 11 December 2025, the decision on whether to withhold reporting content when forwarding it to ENISA lies with the receiving CSIRT.<\/p>\n<h2 id=\"a4-which-internal-responsibilities-must-be-\">Which internal responsibilities must be in place before the first notification<\/h2>\n<p>Regardless of the status of the external platform, companies must already know the CSIRT competent for their main establishment and have an internal triage process that compiles the content for the early warning, notification and final report on the required schedule.<\/p>\n<p>The decision on whether to trigger a notification rarely rests with a single person. It requires a predefined division of roles between the security team, legal department and executive management. This escalation chain for a 24-hour notification must be in place before an incident triggers the deadline, otherwise the available time is used up by internal coordination.<\/p>\n<ul>\n<li>Detection: who technically establishes active exploitation<\/li>\n<li>Decision: who assesses within hours whether a reporting obligation has been triggered<\/li>\n<li>Content: who supplies the information for the 24-hour, 72-hour and 14-day stages<\/li>\n<li>Submission: who operates the web portal of the reporting platform without an automated interface<\/li>\n<\/ul>\n<h2 id=\"a5-what-this-means-for-swiss-manufacturers-\">What this means for Swiss manufacturers with EU market exposure<\/h2>\n<p>Swiss companies that sell products with digital elements in the EU or the EEA fall under the Cyber Resilience Act regardless of where they are based, while Switzerland itself has no comparable horizontal cybersecurity law.<\/p>\n<p>This means the internal process for meeting the deadline cannot wait for a later Swiss regulation, but must follow the EU requirement as soon as a product enters that market. The further requirements of the Cyber Resilience Act concern not only the reporting deadline but also conformity assessment and CE marking.<\/p>\n<p>A first, verifiable step is to determine the competent CSIRT for each affected product based on the EU main establishment, and to run through the internal reporting chain as a test before a real incident triggers the deadline.<\/p>\n<div class=\"rc-bridge\">\n<div class=\"rc-bridge-mark\"><\/div>\n<div>\n<div class=\"rc-bridge-label\">Related<\/div>\n<h3>Document vulnerability reporting paths in a structured way<\/h3>\n<p>The Information Security solution records incidents and vulnerabilities together with their deadlines. It keeps track of who decided and reported, and when.<\/p>\n<p><a href=\"https:\/\/swissgrc.com\/ar\/information-security-management-isms-software\/\">Information Security <span class=\"rc-pfeil\" aria-hidden=\"true\"><\/span><\/a><\/div>\n<\/div>\n<aside class=\"rc-takeaways\">\n<div class=\"rc-takeaways-label\">For practice<\/div>\n<h2>Key points<\/h2>\n<ul>\n<li>The 24-hour deadline runs from the moment of becoming aware, not from confirmation, so the internal escalation chain must already be in place.<\/li>\n<li>The reporting obligation has applied since 11 September 2026, while the related documentation obligations under Article 13 apply only from 11 December 2027.<\/li>\n<li>Shortly before the obligation took effect, the Single Reporting Platform was not yet publicly accessible and offers no interface for automated notifications at launch.<\/li>\n<li>Companies should determine the competent CSIRT based on their EU main establishment now, regardless of the technical status of the reporting platform.<\/li>\n<li>Swiss manufacturers selling into the EU or the EEA are subject to the Cyber Resilience Act regardless of where the company is based.<\/li>\n<\/ul>\n<\/aside>\n<section class=\"rc-faq\">\n<div class=\"rc-faq-head\">\n<div class=\"rc-faq-label\">FAQ<\/div>\n<h2>Frequently asked questions<\/h2>\n<\/div>\n<div class=\"rc-faq-list\">\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">From when does the reporting obligation under Article 14 of the Cyber Resilience Act apply?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>The reporting obligation under Article 14 has applied since 11 September 2026. It requires an initial notification within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident, independent of the later deadline for the general manufacturer obligations under Article 13.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">Which deadlines follow after the initial 24-hour notification?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>After the early warning within 24 hours, the Cyber Resilience Act requires a full notification within 72 hours and a final report no later than 14 days after a corrective measure becomes available. For severe incidents unrelated to a vulnerability, the deadline for the final report is one month instead.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">Was the ENISA reporting platform ready when the obligation took effect?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>Ten days before the deadline, the Single Reporting Platform still had no published URL. At launch it also offered no programming interface, meaning notifications must be submitted through the web portal. The list of national CSIRT designated as coordinators also remained unsettled for a long time.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">Does the Cyber Resilience Act also affect manufacturers based in Switzerland?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>Yes. Swiss companies that sell products with digital elements in the EU or the EEA fall under the Cyber Resilience Act regardless of where the company is based. Switzerland itself has no comparable horizontal cybersecurity law that could replace the internal process.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">Who decides whether reporting content is withheld when forwarded to ENISA?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>Under Implementing Regulation (EU) 2026\/881, issued on 11 December 2025, the receiving CSIRT decides whether reporting content is withheld when forwarded to ENISA, for instance for reasons of public security or ongoing investigations.<\/p>\n<\/div>\n<\/details>\n<\/div>\n<\/section>\n<section class=\"rc-sources\">\n<div class=\"rc-sources-label\">Sources<\/div>\n<ol>\n<li><a href=\"https:\/\/digital-strategy.ec.europa.eu\/en\/policies\/cra-reporting\" target=\"_blank\" rel=\"noopener nofollow\">CRA Reporting<\/a><span class=\"rc-source-pub\">European Commission<\/span><\/li>\n<li><a href=\"https:\/\/www.techtimes.com\/articles\/326249\/20260901\/eu-cyber-resilience-act-reporting-deadline-filing-portal-launches-same-day-it-becomes-mandatory.htm\" target=\"_blank\" rel=\"noopener nofollow\">EU Cyber Resilience Act Reporting Deadline<\/a><span class=\"rc-source-pub\">Techtimes<\/span><\/li>\n<\/ol>\n<\/section>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>The reporting obligation of the Cyber Resilience Act has applied since 11 September 2026 and requires an initial notification within 24 hours of becoming aware of an incident. To meet this deadline, companies must know the competent CSIRT and have an internal escalation chain from detection to reporting decision in place beforehand, regardless of the status of the ENISA reporting platform.<\/p>\n","protected":false},"author":5,"featured_media":70524,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"_eb_attr":"","_swissgrc_real_author":"Shayeste Afzaly","real_author_title":"Marketing Manager","real_author_bio":"Focuses on the operational implementation of marketing initiatives and brand activities. Supports campaigns across digital and offline channels and contributes to a target group-oriented, data-driven execution.","real_author_photo":70096,"footnotes":"","_links_to":"","_links_to_target":""},"categories":[105],"tags":[176,188,189,190,191],"class_list":["post-70523","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-regulation-supervision","tag-article-14-cyber-resilience-act","tag-24-hour-reporting-deadline","tag-enisa-single-reporting-platform","tag-csirt-notification","tag-cyber-resilience-act-switzerland"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO Pro 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"The 24-hour reporting obligation under the Cyber Resilience Act has applied since September 2026. Which internal responsibilities companies need to define now.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"superadmin\"\/>\n\t<meta name=\"google-site-verification\" content=\"google-site-verification=BAztS2wKP0jEfbvHt4_mrvvD17WwzZg1w1A6R9uoQRU\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/swissgrc.com\/ar\/what-companies-should-prepare-organizationally-now\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"ar_AR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Swiss GRC AR | Governance, Risk &amp; Compliance (GRC)\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Cyber Resilience Act: Preparing for the 24-Hour Reporting Obligation\" \/>\n\t\t<meta property=\"og:description\" content=\"The 24-hour reporting obligation under the Cyber Resilience Act has applied since September 2026. Which internal responsibilities companies need to define now.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/swissgrc.com\/ar\/what-companies-should-prepare-organizationally-now\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/24-hour-deadline-cyber-resilience-act-operational-preparation-2-swissgrc.webp\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/24-hour-deadline-cyber-resilience-act-operational-preparation-2-swissgrc.webp\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-09-10T08:13:40+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-09-17T12:38:55+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@SwissGRC\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Cyber Resilience Act: Preparing for the 24-Hour Reporting Obligation\" \/>\n\t\t<meta name=\"twitter:description\" content=\"The 24-hour reporting obligation under the Cyber Resilience Act has applied since September 2026. Which internal responsibilities companies need to define now.\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@SwissGRC\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/24-hour-deadline-cyber-resilience-act-operational-preparation-2-swissgrc.webp\" \/>\n\t\t<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t\t<meta name=\"twitter:data1\" content=\"superadmin\" \/>\n\t\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/what-companies-should-prepare-organizationally-now\\\/#blogposting\",\"name\":\"Cyber Resilience Act: Preparing for the 24-Hour Reporting Obligation\",\"headline\":\"Cyber Resilience Act: What Companies Should Prepare Organizationally Now\",\"author\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/superadmin\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/wp-content\\\/uploads\\\/sites\\\/5\\\/2026\\\/09\\\/24-hour-deadline-cyber-resilience-act-operational-preparation-2-swissgrc.webp\",\"width\":1200,\"height\":630,\"caption\":\"Swiss GRC article image showing the logo and an abstract layers graphic in magenta, category Prepare for the 24-hour deadline\"},\"datePublished\":\"2026-09-10T10:13:40+02:00\",\"dateModified\":\"2026-09-17T14:38:55+02:00\",\"inLanguage\":\"ar\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/what-companies-should-prepare-organizationally-now\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/what-companies-should-prepare-organizationally-now\\\/#webpage\"},\"articleSection\":\"Regulation &amp; Supervision, Article 14 Cyber Resilience Act, 24-hour reporting deadline, ENISA Single Reporting Platform, CSIRT notification, Cyber Resilience Act Switzerland\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/what-companies-should-prepare-organizationally-now\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/category\\\/regulation-supervision\\\/#listItem\",\"name\":\"Regulation &amp; Supervision\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/category\\\/regulation-supervision\\\/#listItem\",\"position\":2,\"name\":\"Regulation &amp; Supervision\",\"item\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/category\\\/regulation-supervision\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/what-companies-should-prepare-organizationally-now\\\/#listItem\",\"name\":\"Cyber Resilience Act: What Companies Should Prepare Organizationally Now\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/what-companies-should-prepare-organizationally-now\\\/#listItem\",\"position\":3,\"name\":\"Cyber Resilience Act: What Companies Should Prepare Organizationally Now\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/category\\\/regulation-supervision\\\/#listItem\",\"name\":\"Regulation &amp; Supervision\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#organization\",\"name\":\"Swiss GRC AG\",\"description\":\"Swiss GRC delivers Software Solutions for GRC, CLM &amp; BPM, helping businesses worldwide manage risks, ensure compliance, and drive success.\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/\",\"telephone\":\"+41412207500\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2023\\\/06\\\/Logo_V1_Original_mit_Claim.png\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/what-companies-should-prepare-organizationally-now\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/what-companies-should-prepare-organizationally-now\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.twitter.com\\\/SwissGRC\",\"https:\\\/\\\/www.instagram.com\\\/swissgrc\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCy4QuXYekCQrA4n5oEwJSJg\",\"https:\\\/\\\/ch.linkedin.com\\\/company\\\/swissgrc\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/superadmin\\\/#author\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/superadmin\\\/\",\"name\":\"superadmin\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/what-companies-should-prepare-organizationally-now\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/75672523c5e2db95feb2c8c3d6cf134b011e26e6f14621731855ff4a8c3327d7?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"superadmin\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/what-companies-should-prepare-organizationally-now\\\/#webpage\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/what-companies-should-prepare-organizationally-now\\\/\",\"name\":\"Cyber Resilience Act: Preparing for the 24-Hour Reporting Obligation\",\"description\":\"The 24-hour reporting obligation under the Cyber Resilience Act has applied since September 2026. Which internal responsibilities companies need to define now.\",\"inLanguage\":\"ar\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/what-companies-should-prepare-organizationally-now\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/superadmin\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/superadmin\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/wp-content\\\/uploads\\\/sites\\\/5\\\/2026\\\/09\\\/24-hour-deadline-cyber-resilience-act-operational-preparation-2-swissgrc.webp\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/what-companies-should-prepare-organizationally-now\\\/#mainImage\",\"width\":1200,\"height\":630,\"caption\":\"Swiss GRC article image showing the logo and an abstract layers graphic in magenta, category Prepare for the 24-hour deadline\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/what-companies-should-prepare-organizationally-now\\\/#mainImage\"},\"datePublished\":\"2026-09-10T10:13:40+02:00\",\"dateModified\":\"2026-09-17T14:38:55+02:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#website\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/\",\"name\":\"Swiss GRC - Software Solutions for GRC, CLM &amp; BPM\",\"description\":\"Governance, Risk & Compliance (GRC)\",\"inLanguage\":\"ar\",\"publisher\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>Cyber Resilience Act: Preparing for the 24-Hour Reporting Obligation<\/title>\n\n","aioseo_head_json":{"title":"Cyber Resilience Act: Preparing for the 24-Hour Reporting Obligation","description":"The 24-hour reporting obligation under the Cyber Resilience Act has applied since September 2026. Which internal responsibilities companies need to define now.","canonical_url":"https:\/\/swissgrc.com\/ar\/what-companies-should-prepare-organizationally-now\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"google-site-verification":"google-site-verification=BAztS2wKP0jEfbvHt4_mrvvD17WwzZg1w1A6R9uoQRU","miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/swissgrc.com\/ar\/what-companies-should-prepare-organizationally-now\/#blogposting","name":"Cyber Resilience Act: Preparing for the 24-Hour Reporting Obligation","headline":"Cyber Resilience Act: What Companies Should Prepare Organizationally Now","author":{"@id":"https:\/\/swissgrc.com\/ar\/author\/superadmin\/#author"},"publisher":{"@id":"https:\/\/swissgrc.com\/ar\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/24-hour-deadline-cyber-resilience-act-operational-preparation-2-swissgrc.webp","width":1200,"height":630,"caption":"Swiss GRC article image showing the logo and an abstract layers graphic in magenta, category Prepare for the 24-hour deadline"},"datePublished":"2026-09-10T10:13:40+02:00","dateModified":"2026-09-17T14:38:55+02:00","inLanguage":"ar","mainEntityOfPage":{"@id":"https:\/\/swissgrc.com\/ar\/what-companies-should-prepare-organizationally-now\/#webpage"},"isPartOf":{"@id":"https:\/\/swissgrc.com\/ar\/what-companies-should-prepare-organizationally-now\/#webpage"},"articleSection":"Regulation &amp; Supervision, Article 14 Cyber Resilience Act, 24-hour reporting deadline, ENISA Single Reporting Platform, CSIRT notification, Cyber Resilience Act Switzerland"},{"@type":"BreadcrumbList","@id":"https:\/\/swissgrc.com\/ar\/what-companies-should-prepare-organizationally-now\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/#listItem","position":1,"name":"Home","item":"https:\/\/swissgrc.com\/ar\/","nextItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/#listItem","name":"Regulation &amp; Supervision"}},{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/#listItem","position":2,"name":"Regulation &amp; Supervision","item":"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/","nextItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/what-companies-should-prepare-organizationally-now\/#listItem","name":"Cyber Resilience Act: What Companies Should Prepare Organizationally Now"},"previousItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/what-companies-should-prepare-organizationally-now\/#listItem","position":3,"name":"Cyber Resilience Act: What Companies Should Prepare Organizationally Now","previousItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/#listItem","name":"Regulation &amp; Supervision"}}]},{"@type":"Organization","@id":"https:\/\/swissgrc.com\/ar\/#organization","name":"Swiss GRC AG","description":"Swiss GRC delivers Software Solutions for GRC, CLM &amp; BPM, helping businesses worldwide manage risks, ensure compliance, and drive success.","url":"https:\/\/swissgrc.com\/ar\/","telephone":"+41412207500","logo":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2023\/06\/Logo_V1_Original_mit_Claim.png","@id":"https:\/\/swissgrc.com\/ar\/what-companies-should-prepare-organizationally-now\/#organizationLogo"},"image":{"@id":"https:\/\/swissgrc.com\/ar\/what-companies-should-prepare-organizationally-now\/#organizationLogo"},"sameAs":["https:\/\/www.twitter.com\/SwissGRC","https:\/\/www.instagram.com\/swissgrc\/","https:\/\/www.youtube.com\/channel\/UCy4QuXYekCQrA4n5oEwJSJg","https:\/\/ch.linkedin.com\/company\/swissgrc"]},{"@type":"Person","@id":"https:\/\/swissgrc.com\/ar\/author\/superadmin\/#author","url":"https:\/\/swissgrc.com\/ar\/author\/superadmin\/","name":"superadmin","image":{"@type":"ImageObject","@id":"https:\/\/swissgrc.com\/ar\/what-companies-should-prepare-organizationally-now\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/75672523c5e2db95feb2c8c3d6cf134b011e26e6f14621731855ff4a8c3327d7?s=96&d=mm&r=g","width":96,"height":96,"caption":"superadmin"}},{"@type":"WebPage","@id":"https:\/\/swissgrc.com\/ar\/what-companies-should-prepare-organizationally-now\/#webpage","url":"https:\/\/swissgrc.com\/ar\/what-companies-should-prepare-organizationally-now\/","name":"Cyber Resilience Act: Preparing for the 24-Hour Reporting Obligation","description":"The 24-hour reporting obligation under the Cyber Resilience Act has applied since September 2026. Which internal responsibilities companies need to define now.","inLanguage":"ar","isPartOf":{"@id":"https:\/\/swissgrc.com\/ar\/#website"},"breadcrumb":{"@id":"https:\/\/swissgrc.com\/ar\/what-companies-should-prepare-organizationally-now\/#breadcrumblist"},"author":{"@id":"https:\/\/swissgrc.com\/ar\/author\/superadmin\/#author"},"creator":{"@id":"https:\/\/swissgrc.com\/ar\/author\/superadmin\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/24-hour-deadline-cyber-resilience-act-operational-preparation-2-swissgrc.webp","@id":"https:\/\/swissgrc.com\/ar\/what-companies-should-prepare-organizationally-now\/#mainImage","width":1200,"height":630,"caption":"Swiss GRC article image showing the logo and an abstract layers graphic in magenta, category Prepare for the 24-hour deadline"},"primaryImageOfPage":{"@id":"https:\/\/swissgrc.com\/ar\/what-companies-should-prepare-organizationally-now\/#mainImage"},"datePublished":"2026-09-10T10:13:40+02:00","dateModified":"2026-09-17T14:38:55+02:00"},{"@type":"WebSite","@id":"https:\/\/swissgrc.com\/ar\/#website","url":"https:\/\/swissgrc.com\/ar\/","name":"Swiss GRC - Software Solutions for GRC, CLM &amp; BPM","description":"Governance, Risk & Compliance (GRC)","inLanguage":"ar","publisher":{"@id":"https:\/\/swissgrc.com\/ar\/#organization"}}]},"og:locale":"ar_AR","og:site_name":"Swiss GRC AR | Governance, Risk &amp; Compliance (GRC)","og:type":"article","og:title":"Cyber Resilience Act: Preparing for the 24-Hour Reporting Obligation","og:description":"The 24-hour reporting obligation under the Cyber Resilience Act has applied since September 2026. Which internal responsibilities companies need to define now.","og:url":"https:\/\/swissgrc.com\/ar\/what-companies-should-prepare-organizationally-now\/","og:image":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/24-hour-deadline-cyber-resilience-act-operational-preparation-2-swissgrc.webp","og:image:secure_url":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/24-hour-deadline-cyber-resilience-act-operational-preparation-2-swissgrc.webp","og:image:width":1200,"og:image:height":630,"article:published_time":"2026-09-10T08:13:40+00:00","article:modified_time":"2026-09-17T12:38:55+00:00","twitter:card":"summary_large_image","twitter:site":"@SwissGRC","twitter:title":"Cyber Resilience Act: Preparing for the 24-Hour Reporting Obligation","twitter:description":"The 24-hour reporting obligation under the Cyber Resilience Act has applied since September 2026. Which internal responsibilities companies need to define now.","twitter:creator":"@SwissGRC","twitter:image":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/24-hour-deadline-cyber-resilience-act-operational-preparation-2-swissgrc.webp","twitter:label1":"Written by","twitter:data1":"superadmin","twitter:label2":"Est. reading time","twitter:data2":"6 minutes"},"aioseo_meta_data":{"post_id":"70523","title":"Cyber Resilience Act: Preparing for the 24-Hour Reporting Obligation","description":"The 24-hour reporting obligation under the Cyber Resilience Act has applied since September 2026. Which internal responsibilities companies need to define now.","keywords":null,"keyphrases":{"focus":{"keyphrase":"Cyber Resilience Act reporting obligation","score":0,"analysis":[]},"additional":[{"keyphrase":"Article 14 Cyber Resilience Act","score":0,"analysis":[]},{"keyphrase":"24-hour reporting deadline","score":0,"analysis":[]},{"keyphrase":"ENISA Single Reporting Platform","score":0,"analysis":[]},{"keyphrase":"CSIRT notification","score":0,"analysis":[]},{"keyphrase":"Cyber Resilience Act Switzerland","score":0,"analysis":[]}]},"primary_term":null,"canonical_url":null,"og_title":"Cyber Resilience Act: Preparing for the 24-Hour Reporting Obligation","og_description":"The 24-hour reporting obligation under the Cyber Resilience Act has applied since September 2026. Which internal responsibilities companies need to define now.","og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":"Cyber Resilience Act: Preparing for the 24-Hour Reporting Obligation","twitter_description":"The 24-hour reporting obligation under the Cyber Resilience Act has applied since September 2026. Which internal responsibilities companies need to define now.","schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"seo_analyzer_scan_date":"2026-09-17 12:39:45","breadcrumb_settings":null,"limit_modified_date":false,"open_ai":null,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-09-10 10:13:40","updated":"2026-09-17 13:13:11","focus_keyword":"Cyber Resilience Act reporting obligation","additional_keywords":[{"word":"Article 14 Cyber Resilience Act","score":83,"items":{"introductionKeyword":{"score":9},"keyphraseLength":{"score":6},"keyphraseDensity":{"score":9},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}},{"word":"24-hour reporting deadline","score":74,"items":{"introductionKeyword":{"score":6},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}},{"word":"ENISA Single Reporting Platform","score":69,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}},{"word":"CSIRT notification","score":69,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}},{"word":"Cyber Resilience Act Switzerland","score":69,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}}],"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/swissgrc.com\/ar\/\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/\" title=\"Regulation &amp; Supervision\">Regulation &amp; Supervision<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\tCyber Resilience Act: What Companies Should Prepare Organizationally Now\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/swissgrc.com\/ar\/"},{"label":"Regulation &amp; Supervision","link":"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/"},{"label":"Cyber Resilience Act: What Companies Should Prepare Organizationally Now","link":"https:\/\/swissgrc.com\/ar\/what-companies-should-prepare-organizationally-now\/"}],"_links":{"self":[{"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/posts\/70523","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/comments?post=70523"}],"version-history":[{"count":2,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/posts\/70523\/revisions"}],"predecessor-version":[{"id":70563,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/posts\/70523\/revisions\/70563"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/media\/70524"}],"wp:attachment":[{"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/media?parent=70523"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/categories?post=70523"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/tags?post=70523"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}