How do I access and register on the SRP, and what are the roles of Primary and Secondary ARs?

The SRP is available at: https://portal.cra-srp.enisa.europa.eu.

Assigned Representatives (ARs) of manufacturers and, once applicable, open-source software stewards must have an EU Login account with multi-factor authentication (MFA) enabled and use it to register on the SRP. An EU Login account can be created in advance at the following link: https://ecas.ec.europa.eu/cas/login. No additional corporate entity authentication mechanism is currently used by the SRP.

EU Login accounts are personal, and MFA is required to access the platform. Therefore, ARs submitting notifications should use their own EU Login accounts.

A Primary AR can register directly on the SRP by selecting the relevant CSIRT Designated as Coordinator (CDaC), providing the required manufacturer information, and creating the initial association with the manufacturer. A Secondary AR can register on the SRP and be associated with a manufacturer after receiving an invitation from the Primary AR and confirming the pre-filled manufacturer information.

There can be only one Primary AR per manufacturer and up to 20 Secondary ARs. The Primary AR is the main administrative representative for the manufacturer in the SRP and has additional administrative permissions, including managing the manufacturer association and inviting or removing Secondary ARs. A Primary AR must first have a validated AR–manufacturer association, displayed as “Verified”, before inviting Secondary ARs. Both Primary and Secondary ARs can submit and update notifications for the manufacturer, subject to their respective access permissions.

The Primary AR can access all notifications associated with the manufacturer, whereas a Secondary AR can access only the notifications they submitted themselves. A Secondary AR does not have the same administrative permissions as the Primary AR but may claim the Primary AR role, subject to review and approval by the designated CSIRT.

ARs can check their current role and manufacturer association status under Settings > Association Management.

The AR–manufacturer association is validated by the designated CSIRT. The specific validation procedure and processing time may vary between CSIRTs and remain the responsibility of the relevant CSIRT. Verification takes place in parallel with the reporting process and does not prevent an AR from submitting notifications while validation is pending. ARs whose manufacturer association has not yet been verified may submit up to 20 notifications for that manufacturer before verification becomes mandatory.

To limit the validation workload for designated CSIRTs, manufacturers and, once applicable, open-source software stewards are advised to register and initiate the validation process only when they need to submit a notification. Provided that the AR already has an active EU Login account, registration on the SRP takes just a few minutes.

More information on registration, AR roles, and use of the platform is available in the regularly updated ENISA guidance materials.