ENISA opens consultation on security.txt and CVD — NIS 2 & CRA

Luxembourg alert — ENISA has launched a public consultation on a technical advisory covering three concrete deliverables: a security.txt (RFC 9116), a Coordinated Vulnerability Disclosure (CVD) policy, and a security advisory template. Contributions are due by 15 November 2026.

Key facts

On 27 October 2026, ENISA released a draft advisory and a consultation questionnaire, with a 15/11/2026 deadline. The advisory provides: 1) a security.txt file to receive reports, 2) a public CVD policy, 3) a post‑fix security advisory template.

For Luxembourg, ENISA confirms that CIRCL (GOVCERT.LU) is the designated national CSIRT coordinator for CVD (updated 10/09/2026). Companies can leverage this ecosystem to manage sensitive, multi‑party disclosures.

Since 11/09/2026, manufacturers must report via ENISA’s Single Reporting Platform (SRP) any actively exploited vulnerability and any serious incident affecting the security of products with digital elements. The SRP tool and FAQ detail required fields and security contacts (including ENISA’s security.txt contact point).

Legal basis

• Cyber Resilience Act (CRA): Article 14 (24/72h timelines) and Annex I, Part II (vulnerability engineering and management) require a structured vulnerability handling process from intake to communication.
• NIS 2 (Directive 2022/2555): Article 12 establishes CVD and mandates a CSIRT coordinator per Member State, with CIRCL listed for Luxembourg. See our overview to position these duties within the scope of essential entities: NIS 2 and coordinated vulnerability disclosure governance.
• ENISA ecosystem: ENISA operates the SRP, supports the CSIRT network, and publishes CVD guidance; the consultation seeks practical alignment for manufacturers, notably SMEs.

What this means for Luxembourg companies

• Intake external reports through a clear public channel (/.well-known/security.txt) with a dedicated contact and PGP key.
• Coordinate CVD: a public policy, internal procedure, and involvement of CIRCL for multi‑party cases (supply chain, open source, non‑EU vendors). To accelerate governance and playbooks, consider cyber leadership via a fractional CISO.
• Notify via the SRP when active exploitation or serious incidents occur (CRA Art. 14 effective since 11/09/2026).

Timeline impact

The consultation closes on 15/11/2026. Contributing helps secure templates that fit your constraints (SRP fields, triage SLAs, PGP keys, researcher acknowledgements, supplier coordination). Next, execute: publish security.txt, adopt a signed CVD policy, and train the team to report via SRP.

Concrete actions this week

• Download ENISA’s draft advisory and submit feedback before 15/11/2026; list your needs (firmware, multi‑tenant SaaS, OSS) so the templates are production‑ready.
• Publish a valid security.txt at your domain root (/.well-known/security.txt) with a dedicated address and PGP key; update your security contact register.
• Adopt a public CVD policy and an internal procedure aligned with CRA/NIS 2: roles (triage/fix/communication), timelines, and advisory template. A focused cybersecurity audit of vulnerability management helps test readiness and prepare SRP access.

Note

If this topic duplicates a recent Luxgap article, please let us know; at this stage, it does not duplicate the listed facts.

Need hands‑on support for CVD, governance and team training? Get in touch: speak with our Luxembourg experts.

Article generated by Luxgap regulatory watch. For tailored guidance on this topic, contact us.