CRA doc pack generator

Fill in one form and get six editable starter documents: CVD policy, security.txt, vulnerability intake page, 24h/72h/14-day runbook, support-period statement and risk assessment. Not legal advice. Templates + software.

Not legal advice. These are starting templates generated from your answers — review them with a qualified adviser before publishing.

Fields marked * are required.

Product & company Company / maker name * Product name * Current version * Website (https://…) * Product description * Intended use / environment Expected product use time

Security contact & policy Security contact email * Public URL of CVD policy * Vulnerability intake page URL (optional) PGP key URL (optional) Preferred languages (comma-separated) security.txt expiry date * Out of scope for reports

Response timelines Acknowledge reports within (business days) Status updates every (days) Target coordinated disclosure (days)

Incident reporting Security owner (name/role) * Backup owner Designated CSIRT / reporting body Reporting channel How you notify users

Support period Support period end date * End-of-support notice period

← Scope check