cra-audit 2.3.0 → 2.4.1

package/CHANGELOG.md

@@ -8,6 +8,26 @@ Releases are automated: pushing a `vX.Y.Z` tag publishes the package to npm
 (with provenance) and creates the GitHub Release from the matching section
 below, so add the section before running `npm version`.
 
+## [2.4.1] — Clearer CRA Art. 14 notice
+
+### Changed
+
+- The Art. 14 notice is now headed **"dependency with a known exploited vulnerability (CISA KEV)"** instead of "actively exploited vulnerability in a dependency". A KEV match means the vulnerability has been exploited somewhere; the reporting duty applies once you are aware that it is exploitable in your product (CRA Art. 3(42) and Art. 14(1)). The 24 h / 72 h / 14 days deadlines run from that awareness, not from the KEV listing.
+- README and the Spanish INCIBE-CERT guide describe KEV matches as a trigger to assess and document with VEX, not as a started reporting clock.
+
+## [2.4.0] — Report to your country's CSIRT (INCIBE-CERT for Spain)
+
+### Highlights
+
+- **`--country`** (policy `country`, action input `country`): the country of your main establishment decides where CRA Art. 14 notifications go. For **Spain**, the Art. 14 notice now shows INCIBE-CERT's procedure, verified against [INCIBE-CERT's CRA guidance](https://www.incibe.es/incibe-cert/blog/reglamento-de-ciberresiliencia-cra-que-es-quien-afecta-y-como-prepararse): SRP access requested from INCIBE (cve-coordination@incibe.es) with prior validation, incidents outside the CRA to incidencias@incibe-cert.es, and INCIBE's usual channels when in doubt.
+- The JSON report carries a **`reporting`** block (CSIRT, SRP, deadlines, steps) for automation.
+- **`readiness --init --lang es`** writes Spanish `SECURITY.md` and `security.txt` templates; with `--country ES` they include the INCIBE-CERT section, and `readiness` checks that the coordinating CSIRT is named. The checks understand Spanish wording.
+- 🇪🇸 New guide in Spanish: [docs/es/notificar-incibe.md](docs/es/notificar-incibe.md).
+
+### Fixes
+
+- `require('cra-audit/package.json')` works again: the manifest is exported alongside the API, so tools that read dependency versions this way no longer fail with `ERR_PACKAGE_PATH_NOT_EXPORTED`.
+
 ## [2.3.0] — Python, Go and Java without an SBOM tool
 
 ### Highlights

package/README.md

@@ -55,13 +55,13 @@ Checks every **direct and transitive** dependency, at the exact version pinned i
 | --- | --- | --- |
 | [OSV.dev](https://osv.dev) — GitHub Advisory Database | Known vulnerabilities, with severity, CVE aliases and the version that fixes them | Fails at or above `--fail-on` (default `high`) |
 | OSV.dev — [OpenSSF malicious packages](https://github.com/ossf/malicious-packages) | Compromised releases (`MAL-*`), e.g. the Shai-Hulud worm versions | **Always fails**; cannot be allowlisted |
-| [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) | Vulnerabilities with evidence of **active exploitation** | Fails by default (`--no-fail-on-kev` to only warn) and prints the CRA Art. 14 reporting clock |
+| [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) | Vulnerabilities with evidence of **active exploitation** | Fails by default (`--no-fail-on-kev` to only warn) and shows the CRA Art. 14 deadlines that apply if it affects your product |
 
 ```text
   HIGH     [KEV] vite@6.2.3  (fix: vite@6.4.3)
     GHSA-4r4m-qw57-chr8 / CVE-2025-31125 Vite has a `server.fs.deny` bypassed … [KEV since 2026-01-22]
 
-⚠ CRA Art. 14 — actively exploited vulnerability in a dependency
+⚠ CRA Art. 14 — dependency with a known exploited vulnerability (CISA KEV)
     • Early warning ........ within 24 hours of becoming aware
     • Notification ......... within 72 hours
     • Final report ......... within 14 days after a corrective measure is available
@@ -69,7 +69,7 @@ Checks every **direct and transitive** dependency, at the exact version pinned i
 
 Only package names and versions are sent to `api.osv.dev`; the KEV catalogue is downloaded from cisa.gov (or CISA's GitHub mirror). If KEV cannot be reached the report says so instead of silently passing, and if OSV.dev is unreachable the audit falls back to `npm audit`. `--vuln-source npm` uses `npm audit` directly.
 
-> CRA Annex I Part I (2)(a) — *placed on the market without known exploitable vulnerabilities*. Art. 14 — *actively exploited vulnerabilities must be reported within 24 hours*.
+> CRA Annex I Part I (2)(a) — *placed on the market without known exploitable vulnerabilities*. Art. 14 — *any actively exploited vulnerability contained in the product* must be notified, with an early warning within 24 hours of becoming aware. A KEV match means the vulnerability has been exploited somewhere: assess whether it is exploitable in your product and record the decision with VEX.
 
 ### 3. Third-party component check
 
@@ -171,7 +171,7 @@ Findings point at the exact line of the manifest (in the console and in SARIF).
 
 **Input SBOM (`-i`), any language:**
 
-`audit`, `vuln`, `licenses` and `vex` accept an existing **CycloneDX JSON**, **SPDX 2.x JSON** or **SPDX 3.0 JSON-LD** SBOM instead of the npm lockfile. Every component is looked up in OSV.dev by its **Package URL**, so you get the same checks — known vulnerabilities, **malicious packages**, **CISA KEV** with the Art. 14 clock, licenses, VEX and SARIF — for any ecosystem OSV covers (Maven, PyPI, Go, crates.io, NuGet, Packagist, RubyGems, Hex, Pub, npm…).
+`audit`, `vuln`, `licenses` and `vex` accept an existing **CycloneDX JSON**, **SPDX 2.x JSON** or **SPDX 3.0 JSON-LD** SBOM instead of the npm lockfile. Every component is looked up in OSV.dev by its **Package URL**, so you get the same checks — known vulnerabilities, **malicious packages**, **CISA KEV** with the Art. 14 deadlines, licenses, VEX and SARIF — for any ecosystem OSV covers (Maven, PyPI, Go, crates.io, NuGet, Packagist, RubyGems, Hex, Pub, npm…).
 
 ```bash
 # Generate the SBOM with the tool of your ecosystem…
@@ -200,6 +200,21 @@ Notes:
 - The input SBOM is also checked against TR-03183-2; since third-party generators rarely include the manufacturer fields, gaps are reported as a **warning** in the audit (`cra-audit sbom check -i` shows the details and fails on them). For npm projects, `cra-audit sbom generate` produces a conforming SBOM.
 - SARIF alerts point at the line of the component's purl in the SBOM file.
 
+### 9. Where to report: your country's CSIRT (`--country`)
+
+CRA Art. 14 notifications go through ENISA's Single Reporting Platform to the CSIRT of your main establishment's Member State. Set it once (`"country": "ES"` in `.cra-audit.json`, `--country ES`, or the action's `country` input) and the Art. 14 notice, the JSON report (`reporting`) and `readiness` include that CSIRT's procedure.
+
+**Spain — INCIBE-CERT** (verified against [INCIBE-CERT's CRA guidance](https://www.incibe.es/incibe-cert/blog/reglamento-de-ciberresiliencia-cra-que-es-quien-afecta-y-como-prepararse), 2026-09-09):
+
+- SRP access is requested from INCIBE at **cve-coordination@incibe.es**, which validates the manufacturer before registration — request it before you need it.
+- Incidents outside the CRA: **incidencias@incibe-cert.es**. Undisclosed vulnerabilities needing a CVE: INCIBE's CNA (**cve-coordination@incibe.es**).
+- In doubt, report through INCIBE-CERT's usual channels; INCIBE tells you whether to file it in the SRP.
+- `npx cra-audit readiness --init --lang es --country ES` writes a Spanish `SECURITY.md` with this procedure.
+
+🇪🇸 Guía en español: [Notificar al INCIBE-CERT según el CRA](docs/es/notificar-incibe.md).
+
+Other countries get the generic EU procedure for now; contributions with verified CSIRT procedures are welcome.
+
 ---
 
 ## Usage
@@ -265,6 +280,8 @@ cra-audit --help
 | `--fail-on <sev>` | Minimum severity that fails the audit: `info`, `low`, `moderate`, `high`, `critical`. |
 | `--vuln-source <src>` | `osv` (default: OSV.dev + CISA KEV) or `npm` (`npm audit`). |
 | `--no-fail-on-kev` | Report actively exploited (CISA KEV) vulnerabilities as a warning instead of failing. |
+| `--country <cc>` | Country of your main establishment (e.g. `ES`): the Art. 14 notice and `readiness` include its CSIRT's procedure. |
+| `--lang <en|es>` | Language of the `readiness --init` templates. |
 | `--production`, `--prod` | Audit production dependencies only. |
 | `--no-sbom` | Do not require an SBOM in the full audit. |
 | `--json` | Machine-readable JSON output. |
@@ -320,6 +337,7 @@ Create a `.cra-audit.json` file at the project root to customize the rules (ther
 {
   "failOn": "high",
   "failOnKev": true,
+  "country": "ES",
   "vulnerabilitySource": "osv",
   "requireSbom": true,
   "sbomFormat": "cyclonedx",
@@ -337,6 +355,7 @@ Create a `.cra-audit.json` file at the project root to customize the rules (ther
 ```
 
 - `failOn`: minimum severity that blocks the audit.
+- `country`: ISO code of your main establishment (e.g. `ES`); decides the CSIRT in the Art. 14 guidance.
 - `failOnKev`: fail when a dependency has an actively exploited vulnerability (CISA KEV). Default `true`.
 - `vulnerabilitySource`: `osv` (OSV.dev + CISA KEV) or `npm` (`npm audit`).
 - `requireSbom`: require the SBOM to meet the TR-03183-2 required data fields.
@@ -414,6 +433,7 @@ Every finding shows up in **Security → Code scanning**, pointing at the exact
 | `fail-on` | `high` | Minimum severity that fails the job. |
 | `fail-on-kev` | `true` | Fail on actively exploited (CISA KEV) vulnerabilities. |
 | `production` | `false` | Production dependencies only. |
+| `country` | — | Country of your main establishment (e.g. `ES`) for the Art. 14 CSIRT steps. |
 | `sarif` | `cra-audit.sarif` | SARIF path (empty to skip). |
 | `upload-sarif` | `true` | Upload to code scanning (needs `security-events: write`; private repos need GitHub Advanced Security). |
 | `sbom` / `vex` | — | Also write the SBOM / VEX to these paths. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cra-audit",
-  "version": "2.3.0",
+  "version": "2.4.1",
   "description": "Audits npm, yarn, and pnpm projects for compliance with the European Cyber Resilience Act (CRA, EU Regulation 2024/2847) and BSI TR-03183: SBOM (CycloneDX/SPDX), known vulnerabilities, third-party components, and licenses.",
   "homepage": "https://github.com/migohe14/cra-audit#readme",
   "repository": {
@@ -37,7 +37,8 @@
   },
   "main": "src/index.js",
   "exports": {
-    ".": "./src/index.js"
+    ".": "./src/index.js",
+    "./package.json": "./package.json"
   },
   "files": [
     "bin",

package/src/cli.js

@@ -167,6 +167,8 @@ function setFlag(flags, name, value) {
     case '--no-fail-on-kev': flags.noFailOnKev = value; break;
     case '--sarif': flags.sarif = value; break;
     case '--init': flags.init = value; break;
+    case '--country': flags.country = value; break;
+    case '--lang': flags.lang = String(value).toLowerCase(); break;
     case '--verbose': flags.verbose = value; break;
     default:
       // Unknown flag stored under its raw name for forward compatibility.
@@ -206,6 +208,8 @@ ${c.bold('OPTIONS')}
   ${c.cyan('--fail-on <sev>')}       Minimum severity that fails the audit: info|low|moderate|high|critical.
   ${c.cyan('--vuln-source <src>')}   Vulnerability source: osv (default: OSV.dev + CISA KEV) | npm (npm audit).
   ${c.cyan('--no-fail-on-kev')}      Report actively exploited (CISA KEV) vulnerabilities without failing.
+  ${c.cyan('--country <cc>')}        Country of your main establishment (e.g. ES): shows its CSIRT's Art. 14 steps.
+  ${c.cyan('--lang <en|es>')}        Language of the readiness --init templates (default: en).
   ${c.cyan('--production, --prod')}  Audit production dependencies only (skips devDependencies).
   ${c.cyan('--no-sbom')}             Do not require an SBOM in the full audit.
   ${c.cyan('--json')}                Machine-readable JSON output.

package/src/commands/audit.js

@@ -79,6 +79,7 @@ function applyFlagOverrides(policy, flags) {
   if (flags.vulnSource) merged.vulnerabilitySource = flags.vulnSource;
   if (flags.failOnKev) merged.failOnKev = true;
   if (flags.noFailOnKev) merged.failOnKev = false;
+  if (typeof flags.country === 'string') merged.country = flags.country.toUpperCase();
   return merged;
 }
 

package/src/commands/readiness.js

@@ -4,6 +4,7 @@ const fs = require('node:fs');
 const path = require('node:path');
 const { logger, color } = require('../utils/logger');
 const { checkReadiness, writeTemplates } = require('../core/readiness');
+const { loadPolicy } = require('../core/policy');
 
 /**
  * `cra-audit readiness [--init]` — checks the organisational CRA duties that
@@ -15,15 +16,17 @@ const { checkReadiness, writeTemplates } = require('../core/readiness');
  */
 function readinessCommand(flags) {
   const projectRoot = findRepositoryRoot(flags.cwd || process.cwd());
+  const country = typeof flags.country === 'string' ? flags.country.toUpperCase() : policyCountry(projectRoot, flags);
+  const lang = flags.lang === 'es' ? 'es' : 'en';
 
   if (flags.init) {
-    for (const { file, created } of writeTemplates(projectRoot)) {
+    for (const { file, created } of writeTemplates(projectRoot, { lang, country })) {
       if (created) logger.success(`Created ${file} — fill in the TODO placeholders.`);
       else logger.info(`${file} already exists; left untouched.`);
     }
   }
 
-  const result = checkReadiness(projectRoot);
+  const result = checkReadiness(projectRoot, { country });
 
   if (flags.json) {
     process.stdout.write(JSON.stringify(result, null, 2) + '\n');
@@ -67,4 +70,13 @@ function findRepositoryRoot(start) {
   }
 }
 
+/** `country` from .cra-audit.json, if any (a broken policy never blocks readiness). */
+function policyCountry(projectRoot, flags) {
+  try {
+    return loadPolicy(projectRoot, flags.config).policy.country || null;
+  } catch {
+    return null;
+  }
+}
+
 module.exports = { readinessCommand };

package/src/core/auditor.js

@@ -6,6 +6,7 @@ const { validateSbom } = require('./sbom-validator');
 const { checkLicenses } = require('./license-checker');
 const { acceptance } = require('./vex');
 const { loadProject } = require('./project-source');
+const { reportingGuide } = require('./reporting');
 
 /**
  * @typedef {object} AuditResult
@@ -151,6 +152,8 @@ async function runAudit(projectRoot, policy, policySource, options = {}) {
       : getProject(projectRoot, sections),
     policySource,
     generatedAt: new Date().toISOString(),
+    // Where CRA Art. 14 notifications go for the manufacturer's country.
+    reporting: reportingGuide(policy.country),
     sections,
     gate: { passed: reasons.every((r) => r.passed), reasons },
   };

package/src/core/kev.js

@@ -6,7 +6,9 @@ const { fetchJson } = require('../utils/http');
  * CISA Known Exploited Vulnerabilities catalogue: the most complete public
  * list of vulnerabilities with evidence of active exploitation. Under CRA
  * Art. 14 (applicable since 11 September 2026) manufacturers must report
- * actively exploited vulnerabilities in their products within 24 hours.
+ * actively exploited vulnerabilities contained in their products within 24
+ * hours of becoming aware. A KEV match is a signal to assess, not a report
+ * by itself: the vulnerability must be exploitable in the product.
  *
  * The GitHub mirror maintained by CISA is used when the primary feed fails.
  */

package/src/core/policy.js

@@ -20,9 +20,12 @@ const DEFAULT_POLICY = {
   sbomCreator: null,
   // Vulnerability source: `osv` (OSV.dev + CISA KEV) or `npm` (npm audit).
   vulnerabilitySource: 'osv',
-  // Fail when a dependency has an actively exploited vulnerability (CISA KEV),
-  // the trigger of the CRA Art. 14 reporting obligation.
+  // Fail when a dependency has an actively exploited vulnerability (CISA KEV):
+  // if it is exploitable in the product, CRA Art. 14 reporting applies.
   failOnKev: true,
+  // ISO 3166-1 alpha-2 country of the manufacturer's main establishment: it
+  // decides the CSIRT that receives CRA Art. 14 notifications (e.g. "ES").
+  country: null,
   // Audit only production dependencies (recommended for shipped products).
   productionOnly: false,
   vulnerabilities: {

package/src/core/readiness.js

@@ -6,6 +6,7 @@ const { readJson } = require('../utils/fs');
 const { parseLockfile } = require('./lockfile-parser');
 const { repositoryUrl } = require('./installed-metadata');
 const { readManifests } = require('./manifest-reader');
+const { reportingGuide } = require('./reporting');
 
 /**
  * Organisational CRA duties that can be checked from the repository itself:
@@ -30,10 +31,11 @@ const URL = /https?:\/\/\S+/;
 
 /**
  * @param {string} projectRoot
- * @param {{ now?: Date }} [options]
+ * @param {{ now?: Date, country?: string|null }} [options]
+ *   `country`: main establishment (ISO alpha-2); adds its CSIRT's checks.
  * @returns {{ checks: Array<object>, passed: boolean, files: object }}
  */
-function checkReadiness(projectRoot, { now = new Date() } = {}) {
+function checkReadiness(projectRoot, { now = new Date(), country = null } = {}) {
   const checks = [];
   const add = (id, label, level, passed, detail, reference) => checks.push({ id, label, level, passed: Boolean(passed), detail, reference });
 
@@ -54,8 +56,9 @@ function checkReadiness(projectRoot, { now = new Date() } = {}) {
 
   // --- Support period ---------------------------------------------------------
   const supportText = `${securityMd}\n${readme}`;
-  const supportMention = /support(ed)?\s+period|supported\s+until|end\s+of\s+(security\s+)?support|end[-\s]of[-\s]life|\bEOL\b/i.test(supportText);
-  const supportDate = supportMention && /\b(19|20)\d{2}-\d{2}(-\d{2})?\b|\b\d+\s+years?\b/i.test(supportText);
+  // English and Spanish wording ("periodo de soporte", "fin del soporte"…).
+  const supportMention = /support(ed)?\s+period|supported\s+until|end\s+of\s+(security\s+)?support|end[-\s]of[-\s]life|\bEOL\b|periodo\s+de\s+soporte|soporte\s+(de\s+seguridad\s+)?hasta|fin\s+del\s+soporte|fin\s+de\s+vida/i.test(supportText);
+  const supportDate = supportMention && /\b(19|20)\d{2}-\d{2}(-\d{2})?\b|\b\d+\s+(years?|años?)\b/i.test(supportText);
   add('support-period', 'Support period and its end date stated', 'required', supportMention && supportDate,
     !supportMention ? 'No mention of the support period in SECURITY.md or README.md'
       : supportDate ? 'Support period with an end date or duration found' : 'Support period mentioned without an end date',
@@ -63,14 +66,23 @@ function checkReadiness(projectRoot, { now = new Date() } = {}) {
 
   // --- Recommended content ------------------------------------------------------
   add('supported-versions', 'Supported versions listed', 'recommended',
-    /supported\s+versions/i.test(securityMd), 'A "Supported Versions" section in SECURITY.md', 'CRA Annex II (7)');
+    /supported\s+versions|versiones\s+(con\s+soporte|soportadas)/i.test(securityMd), 'A "Supported Versions" section in SECURITY.md', 'CRA Annex II (7)');
   add('response-timeline', 'Response timeline for reporters', 'recommended',
-    /\b\d+\s*(business\s+)?(hours?|days?|weeks?)\b/i.test(securityMd), 'Acknowledgement / fix time frames in SECURITY.md',
+    /\b\d+\s*(business\s+)?(hours?|days?|weeks?|horas?|d[ií]as?|semanas?)\b/i.test(securityMd), 'Acknowledgement / fix time frames in SECURITY.md',
     'CRA Annex I Part II (5)');
   add('art14-process', 'Art. 14 reporting process (CSIRT / ENISA, 24 h / 72 h)', 'recommended',
-    /ENISA|CSIRT|single\s+reporting\s+platform|24\s*h(ours)?/i.test(securityMd),
+    /ENISA|CSIRT|single\s+reporting\s+platform|24\s*h(ours|oras)?/i.test(securityMd),
     'How actively exploited vulnerabilities and severe incidents are reported', 'CRA Art. 14');
 
+  // The coordinating CSIRT of the manufacturer's country (Art. 14(7)).
+  const local = reportingGuide(country).local;
+  if (local) {
+    add('coordinating-csirt', `Coordinating CSIRT named (${local.csirt})`, 'recommended',
+      new RegExp(local.csirt.split('-')[0], 'i').test(securityMd),
+      `SECURITY.md should say Art. 14 notifications go to ${local.csirt} via the ENISA SRP (access: ${local.srpAccess.contact})`,
+      'CRA Art. 14(7)');
+  }
+
   // --- security.txt (RFC 9116) --------------------------------------------------
   const securityTxtPath = firstExisting(projectRoot, SECURITY_TXT_PATHS);
   const txt = parseSecurityTxt(securityTxtPath ? read(path.join(projectRoot, securityTxtPath)) : '');
@@ -144,7 +156,7 @@ function parseSecurityTxt(text) {
  *
  * @returns {Array<{ file: string, created: boolean }>}
  */
-function writeTemplates(projectRoot, { now = new Date() } = {}) {
+function writeTemplates(projectRoot, { now = new Date(), lang = 'en', country = null } = {}) {
   const pkg = readJson(path.join(projectRoot, 'package.json')) || {};
   const repo = repositoryUrl(pkg.repository);
   const advisories = repo && /github\.com/.test(repo) ? `${repo}/security/advisories/new` : null;
@@ -156,7 +168,7 @@ function writeTemplates(projectRoot, { now = new Date() } = {}) {
   if (existingMd) {
     results.push({ file: existingMd, created: false });
   } else {
-    fs.writeFileSync(path.join(projectRoot, 'SECURITY.md'), securityMdTemplate({ name, major, advisories }));
+    fs.writeFileSync(path.join(projectRoot, 'SECURITY.md'), securityMdTemplate({ name, major, advisories, lang, country }));
     results.push({ file: 'SECURITY.md', created: true });
   }
 
@@ -167,16 +179,26 @@ function writeTemplates(projectRoot, { now = new Date() } = {}) {
     const base = fs.existsSync(path.join(projectRoot, 'public')) ? 'public/.well-known' : '.well-known';
     fs.mkdirSync(path.join(projectRoot, base), { recursive: true });
     const expires = new Date(now.getTime() + 364 * DAY).toISOString().replace(/\.\d{3}Z$/, 'Z');
-    fs.writeFileSync(path.join(projectRoot, base, 'security.txt'), securityTxtTemplate({ advisories, repo, expires }));
+    fs.writeFileSync(path.join(projectRoot, base, 'security.txt'), securityTxtTemplate({ advisories, repo, expires, lang }));
     results.push({ file: `${base}/security.txt`, created: true });
   }
   return results;
 }
 
-function securityMdTemplate({ name, major, advisories }) {
+function securityMdTemplate({ name, major, advisories, lang, country }) {
+  if (lang === 'es') return securityMdTemplateEs({ name, major, advisories, country });
   const channel = advisories
     ? `Report it privately through [GitHub Security Advisories](${advisories}), or by email to TODO: security@example.com.`
     : 'Report it privately by email to TODO: security@example.com.';
+  const local = reportingGuide(country).local;
+  const csirtSection = local && local.country === 'ES' ? `
+### Spain — INCIBE-CERT
+
+Our main establishment is in Spain, so our coordinating CSIRT is **INCIBE-CERT**. Access to the ENISA
+Single Reporting Platform is requested from INCIBE (${local.srpAccess.contact}), which validates the
+manufacturer before registration. Cybersecurity incidents outside the CRA go to ${local.otherChannels[0].contact};
+if we are unsure whether a case is in CRA scope, we report it through INCIBE-CERT's usual channels first.
+` : '';
   return `# Security Policy
 
 ## Supported Versions
@@ -213,15 +235,74 @@ we notify the coordinating CSIRT and ENISA through the Single Reporting Platform
 - a **final report within 14 days** after a corrective measure is available (one month for severe incidents).
 
 Affected users are informed of the issue and of the corrective measures to take.
-`;
+${csirtSection}`;
+}
+
+function securityMdTemplateEs({ name, major, advisories, country }) {
+  const channel = advisories
+    ? `Comunícalo de forma privada mediante [GitHub Security Advisories](${advisories}) o por correo a TODO: security@example.com.`
+    : 'Comunícalo de forma privada por correo a TODO: security@example.com.';
+  const local = reportingGuide(country).local;
+  const csirt = local && local.country === 'ES'
+    ? `nuestro CSIRT coordinador, **INCIBE-CERT**, y a ENISA a través de la plataforma única de notificación (SRP)`
+    : 'el CSIRT coordinador de nuestro Estado miembro y a ENISA a través de la plataforma única de notificación (SRP)';
+  const spain = local && local.country === 'ES' ? `
+### España — INCIBE-CERT
+
+Nuestro establecimiento principal está en España, por lo que nuestro CSIRT coordinador es **INCIBE-CERT**:
+
+- El acceso a la plataforma SRP de ENISA se solicita a INCIBE (${local.srpAccess.contact}), que valida al
+  fabricante antes de completar el registro.
+- Los incidentes de ciberseguridad que no entran en el CRA se comunican a ${local.otherChannels[0].contact}.
+- Si dudamos de si un caso entra en el ámbito del CRA, lo notificamos primero por los canales habituales
+  de INCIBE-CERT, que nos indica si debe registrarse formalmente en la SRP.
+` : '';
+  return `# Política de seguridad
+
+## Versiones con soporte
+
+| Versión | Soporte | Fin del soporte de seguridad |
+| ------- | ------- | ---------------------------- |
+| ${major}.x     | ✅      | TODO: AAAA-MM-DD             |
+| < ${major}.0   | ❌      | —                            |
+
+**Periodo de soporte:** ${name} ${major}.x recibe actualizaciones de seguridad hasta el TODO: AAAA-MM-DD
+(el Reglamento de Ciberresiliencia de la UE prevé al menos 5 años, o el tiempo de uso previsto del producto).
+
+## Cómo comunicar una vulnerabilidad
+
+Por favor, **no** abras una incidencia pública para problemas de seguridad.
+
+${channel}
+
+Indica la versión afectada, una descripción del problema y, si es posible, los pasos para reproducirlo.
+
+## Nuestro proceso (divulgación coordinada de vulnerabilidades)
+
+- Acusamos recibo en un máximo de **3 días hábiles** y enviamos una primera valoración en **10 días hábiles**.
+- Acordamos con quien informa una fecha de publicación, normalmente en **90 días**, y le damos crédito si lo desea.
+- Las correcciones se publican como actualizaciones de seguridad, separadas de las de funcionalidad cuando es
+  posible, y se anuncian en las notas de versión y en un GitHub Security Advisory.
+
+## Reglamento de Ciberresiliencia de la UE — Notificación (art. 14)
+
+Cuando tenemos conocimiento de una vulnerabilidad activamente explotada en ${name}, o de un incidente grave que
+afecte a su seguridad, lo notificamos a ${csirt}:
+
+- una **alerta temprana en 24 horas**,
+- una **notificación en 72 horas**,
+- un **informe final en 14 días** desde que haya una medida correctora (en incidentes graves, un mes tras la notificación).
+
+Informamos a los usuarios afectados del problema y de las medidas que deben aplicar.
+${spain}`;
 }
 
-function securityTxtTemplate({ advisories, repo, expires }) {
+function securityTxtTemplate({ advisories, repo, expires, lang }) {
   const lines = ['# RFC 9116 — https://securitytxt.org', 'Contact: mailto:TODO-security@example.com'];
   if (advisories) lines.push(`Contact: ${advisories}`);
   lines.push(`Expires: ${expires}`);
   if (repo) lines.push(`Policy: ${repo}/blob/HEAD/SECURITY.md`);
-  lines.push('Preferred-Languages: en', '');
+  lines.push(`Preferred-Languages: ${lang === 'es' ? 'es, en' : 'en'}`, '');
   return lines.join('\n');
 }
 

package/src/core/reporting.js

@@ -0,0 +1,79 @@
+'use strict';
+
+/**
+ * Where and how a manufacturer reports under CRA Art. 14. Notifications go
+ * through ENISA's Single Reporting Platform (SRP) to the CSIRT designated as
+ * coordinator of the Member State of the manufacturer's main establishment.
+ *
+ * Country-specific procedures are added only when they have been verified
+ * against the CSIRT's own publications (see `source`).
+ */
+
+const SRP = {
+  url: 'https://portal.cra-srp.enisa.europa.eu',
+  faq: 'https://www.enisa.europa.eu/topics/product-security/single-reporting-platform-srp/frequently-asked-questions',
+};
+
+const DEADLINES = {
+  vulnerability: [
+    { step: 'early-warning', deadline: '24 hours after becoming aware' },
+    { step: 'notification', deadline: '72 hours after becoming aware' },
+    { step: 'final-report', deadline: '14 days after a corrective or mitigating measure is available' },
+  ],
+  incident: [
+    { step: 'early-warning', deadline: '24 hours after becoming aware' },
+    { step: 'notification', deadline: '72 hours after becoming aware' },
+    { step: 'final-report', deadline: '1 month after the 72-hour notification' },
+  ],
+};
+
+const CSIRTS = {
+  ES: {
+    country: 'ES',
+    csirt: 'INCIBE-CERT',
+    website: 'https://www.incibe.es/incibe-cert',
+    srpAccess: {
+      contact: 'cve-coordination@incibe.es',
+      steps: [
+        'Email cve-coordination@incibe.es asking for a user on the ENISA Single Reporting Platform (SRP).',
+        'INCIBE replies with the information and documents it needs, and validates that you are a manufacturer bound by the CRA.',
+        'Once validated, INCIBE sends the instructions to complete the SRP registration and start notifying.',
+      ],
+      advice: 'Request SRP access before you need it: the validation happens before you can notify, and the 24-hour clock does not wait.',
+    },
+    otherChannels: [
+      { purpose: 'Other cybersecurity incidents (outside CRA Art. 14)', contact: 'incidencias@incibe-cert.es' },
+      { purpose: 'Undisclosed (0-day) vulnerabilities needing coordination and a CVE ID (INCIBE CNA)', contact: 'cve-coordination@incibe.es' },
+    ],
+    whenInDoubt: 'If you are not sure a case is in CRA scope, report it through INCIBE-CERT\'s usual channels; INCIBE tells you whether to file it formally in the SRP.',
+    source: 'https://www.incibe.es/incibe-cert/blog/reglamento-de-ciberresiliencia-cra-que-es-quien-afecta-y-como-prepararse',
+    verified: '2026-09-09',
+  },
+};
+
+/**
+ * Reporting guidance for a country (ISO 3166-1 alpha-2), or the generic
+ * EU procedure when the country is unknown or not yet covered.
+ *
+ * @param {string|null|undefined} country
+ */
+function reportingGuide(country) {
+  const code = typeof country === 'string' ? country.trim().toUpperCase() : null;
+  const local = code ? CSIRTS[code] || null : null;
+  return {
+    country: code,
+    platform: 'ENISA Single Reporting Platform (SRP)',
+    srp: SRP,
+    recipients: local
+      ? `${local.csirt} (CSIRT designated as coordinator) and ENISA`
+      : 'the CSIRT designated as coordinator of your main establishment\'s Member State, and ENISA',
+    deadlines: DEADLINES,
+    local,
+  };
+}
+
+function supportedCountries() {
+  return Object.keys(CSIRTS);
+}
+
+module.exports = { reportingGuide, supportedCountries };

package/src/reporters/console.js

@@ -23,14 +23,14 @@ function reportConsole(report) {
     logger.detail(`Policy: ${report.policySource}`);
   }
 
-  if (report.sections.vulnerabilities) renderVulnerabilities(report.sections.vulnerabilities);
+  if (report.sections.vulnerabilities) renderVulnerabilities(report.sections.vulnerabilities, report.reporting);
   if (report.sections.sbom) renderSbom(report.sections.sbom);
   if (report.sections.licenses) renderLicenses(report.sections.licenses);
 
   renderSummary(report);
 }
 
-function renderVulnerabilities(section) {
+function renderVulnerabilities(section, reporting) {
   logger.heading('1) Known vulnerabilities (CRA Annex I · Art. 14)');
   if (!section.ok) {
     logger.error(section.error);
@@ -75,7 +75,7 @@ function renderVulnerabilities(section) {
     logger.detail(`… and ${ordered.length - top.length} more.`);
   }
 
-  if (c.kev) renderArticle14Notice();
+  if (c.kev) renderArticle14Notice(reporting);
   if (c.malicious) {
     logger.log('');
     logger.error(color.bold('Malicious package(s) detected: treat this as a security incident.'));
@@ -97,15 +97,26 @@ function describeSources(section) {
 }
 
 /** CRA Art. 14 reporting clock, shown when a KEV-listed vulnerability is found. */
-function renderArticle14Notice() {
+function renderArticle14Notice(reporting) {
+  const local = reporting && reporting.local;
   logger.log('');
-  logger.warn(color.bold('CRA Art. 14 — actively exploited vulnerability in a dependency'));
+  logger.warn(color.bold('CRA Art. 14 — dependency with a known exploited vulnerability (CISA KEV)'));
   logger.detail('If it affects a product with digital elements you place on the EU market, notify');
-  logger.detail('the coordinating CSIRT and ENISA through the Single Reporting Platform:');
+  logger.detail(`${local ? `${local.csirt} and ENISA` : 'the coordinating CSIRT and ENISA'} through the Single Reporting Platform (SRP):`);
   logger.detail('  • Early warning ........ within 24 hours of becoming aware');
   logger.detail('  • Notification ......... within 72 hours');
   logger.detail('  • Final report ......... within 14 days after a corrective measure is available');
   logger.detail('Assess exploitability in your product first; document the decision either way.');
+  if (local) {
+    logger.log('');
+    logger.detail(color.bold(`${local.csirt} (${local.country}) — access to the SRP:`));
+    local.srpAccess.steps.forEach((step, i) => logger.detail(`  ${i + 1}. ${step}`));
+    logger.detail(`  ${local.srpAccess.advice}`);
+    logger.detail(`  ${local.whenInDoubt}`);
+    logger.detail(`  Source: ${local.source}`);
+  } else {
+    logger.detail(`SRP: ${reporting ? reporting.srp.url : 'https://portal.cra-srp.enisa.europa.eu'} · Set your country (--country, e.g. ES) for its CSIRT's steps.`);
+  }
 }
 
 function describeFix(fix) {