For makers of connected products sold in the EU
Your product just got exploited. Hour one is already written.
The law gives you 24 hours to warn ENISA, 72 to notify, then a final report. IncidentReady writes your runbook with your own people’s names in it and drafts all six notifications before the night you need them, with only the incident facts left to fill in.
Guarantee. If the pack doesn’t surface at least three gaps specific to your company, you don’t pay. The card payment is refunded in full.
The incident, hour by hour
The law starts the clocks. The pack is already open on the desk.
Penalties for breaching the reporting duties run to €15,000,000 or 2.5% of worldwide turnover — figures from the regulation itself, not our marketing.
- T+0
Awareness
Reliable evidence that a vulnerability is being exploited, or an incident that affects the security of the product. The clock has started.
Art. 3 · Art. 14(1)
In the packYour incident lead, technical and legal contacts and deputy, named, with the call order and who may file without waiting. - 24h
Early warning
Whether malicious acts are suspected, and the member states where the product is available. No technical analysis is required.
Art. 14(2)(a) · ENISA SRP
In the packThe early warning, pre-filled with your company and products. - 72h
Notification
General information on the product, the nature of the exploit or incident, and any corrective or mitigating measures.
Art. 14(2)(b) · 14(4)(b)
In the packThe 72-hour notification drafted, and a runbook step by step for both legal tracks. - 14d
1 moFinal report
Fourteen days after your fix is available (vulnerability), or one month after the notification (incident): description, severity, impact, root cause, measures.
Art. 14(2)(c) · 14(4)(c)
In the packThe final report drafted, the user notice, and an evidence register for the log and the timestamps.
What’s in the pack
Specific to your company. That is the whole point.
Generic CRA templates hand you “[RESPONSIBLE PERSON]”. This pack prints your incident lead’s name into the runbook and your products into the drafts.
2
Runbooks, one per legal track
Who does what at hour 0, 24 and 72, with your people named.
6
Notification drafts
Early warning, notification, final report and the user notice, pre-filled.
1
Ranked gap list
No monitoring means you learn late and lose the clock before it starts. What to fix first, and why.
1
Evidence register
The log, the drafts as sent and the timestamps, filed in one place.
15
Minute walkthrough
An agenda so your people know the runbook exists before they need it.
12
Months kept current
Regenerated free when ENISA guidance changes, with the date on every page.
Real pages
Not a mock-up. The actual pack.
Generated by our engine for a fictional company, Acme Devices GmbH, then printed exactly as a buyer would receive it. Your company, products, member state and people replace theirs.
A 15-page PDF, licensed to the buyer by name, with the corpus version and generation date on every page. The sample shows no gaps because the fictional company answered every question well; most real packs do not.
Who you are dealing with
A named person, a registered company.
IncidentReady turns a regulation with a clock into a company-specific document, generated from your answers and honest about what it cannot do. Nothing is filed with ENISA or any CSIRT on your behalf: the reporting duty stays yours. What we build is your readiness to meet it inside 24 hours.
- Founder
- Paul Eccles
- Company
- Harmony Future Holdings Limited
- Registered
- Ireland, No. 802912, Dublin
- Contact
- hello@incidentready.eu
- Tracking
- None. No cookies.
After you pay
Ten minutes of yours. Hour one is ours.
- Today
You pay
By card on Stripe’s secure checkout, or by bank transfer against an invoice.
- About 10 minutes
You answer
Your people, products, monitoring and contacts. That is what gets printed.
- Within 1 working day
We confirm
We check your answers are complete and ask about anything ambiguous.
- Then
The pack arrives
Watermarked PDF by email, regenerated free for 12 months when guidance moves.
Price
Two ways in. No discovery call.
Prices exclude VAT and are quoted for business buyers. VAT is calculated at checkout; EU business customers outside Ireland can give a VAT number there for the reverse charge.
One-off, founding-cohort pricing
Readiness pack
€490
- Company-specific runbook, both legal tracks
- All six notification drafts, pre-filled
- Ranked gap list with remediations
- Regenerated free for 12 months
For teams that never want a stale runbook
Maintained
€990 /yr
- Everything in the pack
- Regenerated on every guidance change
- Change alerts: what moved, and why
- Dated version history
Pilot guarantee: if your pack doesn't surface at least three gaps specific to your company, you don't pay. Two ways to pay: card via Stripe's secure checkout, refunded in full if the pack does not surface three company-specific gaps; or invoice after scoping, with nothing owed until your order is confirmed in writing. This site stores no payment details.
The alternatives: generic €700 template packs, or a four-figure legal-review engagement over weeks, against penalties of up to €15,000,000 or 2.5% of worldwide turnover. Our solicitor's opinion on how these products may lawfully be sold has arrived; the safeguards it sets out are on our terms page. Market price comparisons are third-party figures as at August 2026 and are not quotations.
Questions buyers ask
Read this before you buy.
Stated here rather than in the small print, because a readiness product that overclaims is the one thing that would actually get a customer hurt.
Is this legal advice?
Do you file the notifications with ENISA for us?
Do weekends and holidays count?
What if the pack finds no gaps?
What do I need to provide?
What happens when ENISA guidance changes?
Is the penalty figure real?
Who is behind IncidentReady?
Write hour one before it happens.
Ten minutes of answers. A runbook with your people in it and six notifications drafted in advance.