Preparing for the CRA: an SBOM needs a working process.
Assess components, vulnerability handling and technical evidence for one software product. Prepare an SBOM and a verifiable process.
Read the German originalThe product defines the scope
The Cyber Resilience Act concerns products with digital elements within its scope. The European Commission identifies 11 September 2026 for certain reporting obligations and 11 December 2027 for the main obligations. Particular roles and product situations have specific provisions; classification must precede an implementation plan.
Describe a specific product, its distribution model, components and responsibilities. A general company security concept does not establish which evidence belongs to that product and its lifecycle.
From component inventory to a handled report
A software bill of materials makes dependencies visible. Linking it to the shipped release shows which customer installation might be affected by an advisory. Generating, retaining and associating the SBOM should therefore be part of the build process.
Choose a traceable component advisory for a test. Who assesses whether the product is affected, who decides on a fix and where is the result recorded? The process must also work when information is initially missing or responsibility changes.
Test the evidence for one release
A limited pilot links exactly one release to its component inventory, known findings and decisions. This then reveals which parts can be automated and which need specialist assessment.
Technical tools support the process but do not replace binding classification or conformity assessment. Further work needs a clarified support period and specific responsibilities. The reporting decision remains with the people responsible for it.
What does this look like in your work?
We can turn the idea into a sensible next step with you.
CRA: software inventory and vulnerability workflows · Packages