Every case moves through the same forward-only sequence. There is no state for "late" and no state for "corrected" — both are handled differently than you might expect, and that's the point of this page.
The deadlines behind each transition
| Stage | Deadline | Basis |
|---|---|---|
| Early warning | 24 hours | from recorded awareness |
| Notification | 72 hours | from recorded awareness |
| Final report (vulnerability) | 14 days | from a corrective measure becoming available |
| Final report (incident) | 1 calendar month | from notification submission, clamped at month end |
Why there's no "late" state
Overdue is computed at read time by comparing the stored dueAt against now — it
is never written as its own state. A case that's overdue still shows as
early_warning_drafting, just with an overdue countdown instead of a running one.
This is deliberate: Declara has no way to know whether you've already been in
contact with your CSIRT outside the product, so it detects and surfaces lateness
rather than asserting a consequence it isn't positioned to judge. See
What to do if you're already overdue.
Why there's no "corrected" state
If new information arrives after a stage is submitted, you don't reopen and edit that stage — you carry the correction forward into the next one, mirroring how the SRP's own multi-stage design works (each stage updates and builds on the last rather than replacing it). There is currently no product feature for amending an already-submitted stage in place.
Withdrawal is the one escape hatch
withdrawn is reachable from any non-terminal state and always requires a
written reason. Use it when triage turns out to have been wrong — a false
positive discovered mid-drafting, for instance — rather than leaving a case to
run down a clock that no longer applies.
What Mark submitted actually checks
A case can't move to a *_submitted state without either an SRP reference number
or a note explaining why it was filed outside the SRP. This exists so the case's
history is honest about what actually happened, not just what the clock predicted.