Cyber Resilience Act and NIS2 reporting, run from Jira.
Since 11 September 2026, Article 14 of the Cyber Resilience Act gives manufacturers 24 hours to send an early warning about an actively exploited vulnerability through ENISA’s single reporting platform. NIS2 gives essential and important entities 24 hours for an early warning on a significant incident, and the GDPR 72 hours, where feasible, to notify a personal data breach. Clearlane for Cyber turns the vulnerabilities and incidents your teams already log in Jira into those reports: every deadline counted, fields ready to paste, and a dated evidence file.
Runs on Atlassian Your data stays in your Atlassian site.
The clock runs faster than the paperwork.
Most teams already log vulnerabilities and incidents in Jira. What they lack is the dated record an authority asks for, built while the clock is running.
The clock starts when you knew
Not when the work item was triaged. Without a dated qualification, nobody can say when the 24 hours began.
A form, not an API
ENISA’s platform currently offers no API for submissions, and most authorities take a web form. Someone retypes the facts under pressure, and the version sent is not always kept.
Which versions are affected?
The SBOMs exist, one file per release, but searching them for one component takes longer than the deadline allows.
Three apps for cyber reporting in Jira.
Each app works on its own, on your existing projects and work items. Manufacturers can start with CRA, NIS2 and GDPR teams with Breach & Incident Reporting. Risk Register keeps the risks behind both reviewed on a schedule.
- Clearlane CRA
Report vulnerabilities on time
The 24-hour and 72-hour clocks start from the moment you became aware of the actively exploited vulnerability, recorded in a signed, dated qualification; the 14-day final report clock starts when a fix or mitigation is available. ENISA fields prepared with the platform’s own labels, SBOM search across versions, users informed and a CSAF 2.0 advisory.
- Clearlane Breach & Incident Reporting
Notify incidents and breaches
Qualify once for the GDPR, NIS2 and DORA and see every deadline that follows. Notification texts ready to paste, each submission recorded, a register of every personal data breach.
- Clearlane Risk Register
Review cyber risks regularly
A risk register per project with NIS2 Article 21, CRA Article 13 and ISO 27001 templates: 5 × 5 risk map, actions as linked work items and signed periodic reviews.
Every app starts with a free trial on the Marketplace.
What your security and purchasing teams will ask us.
Ready before you ask. One assessment covers every app, because every app is built, hosted and released the same way.
Supplier assessment, filled in
Company, hosting, security, release process, support and validation materials, on two pages.
Security questionnaire answers
Hosting, data residency, access, vulnerabilities and incidents. Every app is built natively on Atlassian Forge (Runs on Atlassian), with no Connect components. At least 30 days’ notice in the release notes before any functional change that affects signed records, signatures or approval workflows; security fixes ship without delay and are noted in the release notes afterwards.
How we handle our own vulnerabilities
Dependencies audited before every release, an SBOM kept for each release, fixes within the deadlines of Atlassian’s security bug fix policy.
OQ test script for CRA
A ready-to-run operational qualification script, step by step, with expected results.
Useful on their own, even if you never install anything.
Written for the people who will run the process. Share them freely.
The first 24 hours: an early warning template
What each first message must contain under the CRA, NIS2 and the GDPR, with every deadline and a block to fill in.
CRA, a written walkthrough
One actively exploited vulnerability followed from awareness to the security advisory, step by step, with screenshots of the real app.
Ask Rovo, get the app’s own answer.
Each of the three apps adds a Rovo agent: ask in plain words which reporting deadlines are coming up, which notification deadlines are overdue or which cyber risks need attention. It answers from the app’s records, only with what you are allowed to see, and it only reads: it never changes anything.
It works where Rovo is turned on for your Atlassian site; Clearlane adds no AI model of its own.
One person reads and answers, in writing.
Maxime Ragionieri, founder of Clearlane, answers security and compliance teams himself: [email protected].
Send your supplier questionnaire, your intended use or the process you want to see. You get a written answer within two business days and, if it helps, a written walkthrough of that process, screen by screen, before you install anything.
Everything stays in writing, so your security and purchasing files keep a trace of every answer.
Questions, answered.
- Does the app submit our reports to ENISA?
- No. ENISA’s single reporting platform currently offers no API for submissions: the app prepares each field with the platform’s own label and length limit, you paste and submit, then record the submission in Jira.
- Does the CRA apply to medical devices?
- Not to products covered by the MDR or the IVDR: they are outside its scope (Article 2(2)). Your other products with digital elements may still be in scope. For medical devices, see Clearlane for Quality.
- Where is our incident data stored?
- In your Atlassian site, in Atlassian’s Forge storage, following your site’s data residency. Clearlane runs no servers, and the apps never send your content to Clearlane. See our trust center.
- Can we start with one app?
- Yes. Each app is its own Marketplace app with a free trial, and the others are covered by the same supplier assessment.
- How is it billed?
- By Atlassian, on your usual Atlassian invoice, monthly or yearly. The Pricing tab of each Marketplace listing shows the price for your team size.
Start with the deadline that worries you most.
Free trial on the Atlassian Marketplace. Nothing to install outside your Atlassian site.