File the final report

The final report closes out the case. Its deadline is the one place a vulnerability case and an incident case genuinely diverge — get this distinction right before you start drafting:

• Vulnerability case: due 14 days from the corrective or mitigating measure becoming available — not from awareness, and not from notification.
• Incident case: due 1 calendar month from when the 72-hour notification was submitted, clamped to the end of the month if the calendar date doesn't exist (a notification submitted on 31 January is due 28 or 29 February, not 3 March).

Before you start

• You need a case in notification_submitted. If you haven't filed the notification yet, see File the 72-hour notification.
• For a vulnerability case, you need a corrective or mitigating measure's availability date recorded — the final deadline can't be computed without it, and the case shows why the countdown isn't running until you do.
• You need cases.submit permission.

Steps

1. Open the case. For a vulnerability case without a fix date yet, answer When did a corrective or mitigating measure become available? and press Record it — that is what starts this deadline.
2. Open the final report. What earlier stages said is carried over, and what the product knows is pre-filled. Review every field; anything learned since the notification goes here. A filed stage itself is never edited in Declara — see Track a filing for corrections made on the platform.
3. Press Generate packet and copy it into the CRA Single Reporting Platform web form yourself.
4. Return to the case, enter the platform's reference or an offline-filing note, and press Mark as submitted.
5. When the authority has finished with it, press Close the case. Closing is deliberate, not automatic.

What you should see

The case moves to final_submitted, and to closed when you close it. Closed is a terminal state — the case doesn't move again.

Related

• File the 72-hour notification
• The reporting clock, explained
• What to do if you're already overdue