Skip to content
Declara
⌘K
compliance-owner

Understand your first alert

Was this page helpful?

If a Tier A alert has appeared in your workspace, this page is what it means and what to do next. If your alerts list is still empty, that's a correct outcome too — see Quickstart.

Where alerts come from

Every component in your SBOM with a purl is matched against six advisory feeds: NVD, OSV, GHSA, CISA KEV, ENISA's EUVD and EPSS. A match is classified into one of three tiers:

  • Tier A — in the KEV (Known Exploited Vulnerabilities) catalogue, or an EPSS exploitation-probability score at or above the Tier A threshold. This is the only tier that raises an alert and notifies you.
  • Tier B — a meaningful CVSS severity combined with a moderate EPSS score. Shown in your inventory and the weekly digest; no alert.
  • Tier C — recorded in your inventory with no current exploitation signal. No alert, no digest entry.

Tier A/B/C is Declara's own classification, not a CVSS severity rating and not a regulatory term — see the CRA glossary for where Declara's vocabulary and the regulation's part ways.

Steps: opening the alert

  1. Open the alert from your Alerts list.
  2. Read what it's telling you. A Tier A alert means a component you ship appears in an exploitation catalogue or has a high exploitation probability. It is a reason to assess — it is not, by itself, a reportable event, and no legal clock has started yet.
  3. Answer the four triage questions:
    • Is the vulnerable component actually used in the shipped product, not only as a development or test dependency?
    • Is the vulnerable code path reachable, or the affected feature enabled, in our product?
    • Do we have any evidence of exploitation against our product or our users?
    • Is a fix or mitigation already available in a shipped version?
  4. Save your answers. A case can't be opened from an alert until all four are answered — this is enforced by the product, not just a form suggestion.

What you should see

Once triage is complete, a case opens. If your answers indicate this is genuinely an actively exploited vulnerability or a severe incident affecting your product, the reporting clock is now relevant — go to File an initial Article 14 report.

If triage concludes the alert doesn't apply to you — the component isn't actually shipped, the path isn't reachable — you can close it out without opening a reporting case. The judgment is yours; Declara's tiering surfaces the signal, not the verdict.

What opening a real case sets in motion

Opening a case is a record, not a filing. Beside the Article 14 deadlines, a real case (not a drill) can start two other pieces of work:

  • Contractual customer notices. If you have recorded business customers who use the product and asked to hear about this kind of event, Declara plans a notice for each, due at the case's awareness time plus the customer's window, and reminds your team before it falls due. These are contract terms, not Article 14 deadlines, and Declara sends nothing to the customer: you send it yourself. Customer notices need the Growth or Partner plan. See Notify business customers.
  • A report upstream. If the vulnerability is in a component someone else maintains, Article 13(6) has you report it to them, and share a fix if you develop one. Start the record from the case with Report upstream. Declara keeps the record; you report through the maintainer's own channel. See Report a vulnerability upstream.

Related