Cyresora · Quickstart
Cyresora Quickstart, as shipped in the download
The QUICKSTART.txt in the download — the same steps your delivery email carries.
CYRESORA — QUICKSTART
=====================
REQUIREMENTS
------------
- PHP 8.1+ with extensions: pdo, pdo_sqlite (or pdo_mysql)
- MySQL 5.7+ OR SQLite 3 (SQLite requires no extra setup)
- A web server (Apache with mod_rewrite, or Nginx with try_files)
SHARED HOSTING / CPANEL (RECOMMENDED FOR MOST BUYERS)
------------------------------------------------------
1. Upload the contents of the `app/` folder to your web root (e.g. public_html/)
or a subdirectory (e.g. public_html/incidents/).
2. Make sure this directory is writable by PHP:
data/
3. Visit https://yourdomain.com/install/ in your browser.
4. Fill in the installer: database, organisation, timezone, admin account.
5. DELETE the install/ folder.
6. Before you need it: list your products and systems, mark what is in scope,
and name who notifies and their deputy. A 24-hour clock that starts at 02:00
on a Sunday is a rota question before it is a legal one.
VPS / SELF-HOSTED (APACHE)
--------------------------
Point a vhost at the app folder; the shipped .htaccess handles routing.
Ensure `AllowOverride All` is set and mod_rewrite is enabled.
NGINX
-----
location / {
try_files $uri /index.php?$query_string;
}
location ~ ^/(config\.php|data|src|bin|tests|controllers) { deny all; }
LOCAL / EVALUATION (PHP BUILT-IN SERVER)
----------------------------------------
cd app
php -S localhost:8080 router.php
Then open http://localhost:8080/install/ and choose SQLite.
DEMO DATA (OPTIONAL)
--------------------
php bin/demo.php
Demo login (only if no admin exists yet): admin@cyresora.app / admin123
The demo seeds four incidents whose timestamps are computed backwards from the
moment you load it, so the board is genuinely live: one mid-flight, one with an
OVERDUE deadline, one whose one-month final report is running from the moment
the notification was actually submitted, and one whose 14-day clock has NOT
STARTED because no corrective measure exists yet.
BACKUPS
-------
SQLite: back up data/cyresora.sqlite. MySQL: back up your database. Either way,
keep a copy of config.php. Settings -> Backups also produces a redacted JSON
export and a token-authenticated scheduled backup with retention.
THE CLOCKS THIS PRODUCT TRACKS
------------------------------
CRA (Regulation (EU) 2024/2847, Article 14) - applies from 11 September 2026
Actively exploited vulnerability
early warning 24 hours from becoming aware
notification 72 hours from becoming aware
final report 14 days AFTER A CORRECTIVE OR MITIGATING MEASURE IS AVAILABLE
Severe incident
early warning 24 hours from becoming aware
notification 72 hours from becoming aware
final report 1 month AFTER THE SUBMISSION OF THE NOTIFICATION
NIS2 (Directive (EU) 2022/2555, Article 23(4)) - as transposed nationally
early warning 24 hours from becoming aware (a)
notification 72 hours from becoming aware (b)
intermediate on request of the CSIRT (c)
final report 1 month after the submission of the notification (d)
if still ongoing: progress report then, final within one month of
the handling being completed (e)
READ THE ANCHORS, NOT JUST THE DURATIONS. The final-report clocks do NOT run
from when you found out. One runs from the moment a fix exists - which may not
have happened yet, in which case the register says "not started" and names what
starts it, rather than showing you a date it invented. The other runs from the
moment you actually submitted the notification, so filing early genuinely moves
your final-report deadline earlier.
SUPPORT NOTES
-------------
- All stored times are UTC to the second. You type local time; the app converts.
A deadline measured in hours cannot survive a timezone left implicit.
- THESE CLOCKS DO NOT STOP AT THE WEEKEND. There is no working-day carve-out in
either instrument. The register marks the deadlines that fall on a Saturday or
Sunday rather than letting you assume otherwise.
- Recording a notification is a separate permission (`notify.submit`). A member
can work an incident; declaring that a report went out is what an authority is
later shown, so it is not the same right.
- NIS2 is a DIRECTIVE. What binds you is your Member State's transposition -
the authority, and sometimes the detail. Record yours in Settings.
- Cyresora is a records and timing aid, not legal advice.
← Back to Cyresora · Manual · API · Test run