Guides to the CRA's supply chain duties: component due diligence, SBOM tooling, vulnerability management across dependencies and third-party cloud services built into a product.
How to carry out the due diligence Article 13(5) requires for third-party and open-source components: what to verify and how, the Commission's list of actions, sandboxing critical components, reporting upstream, and future voluntary attestation for FOSS.
Choosing tools to produce and use the SBOM the CRA requires: what the SBOM must cover and who receives it, the format still undecided at EU level, and open-source tools that generate SBOMs and track component vulnerabilities.
Setting up the vulnerability handling process the CRA expects across a product's support period: identifying vulnerabilities, risk-based remediation rather than patching everything, separate security updates, keeping updates available, and tooling to track findings.
How the CRA treats cloud services a product depends on: when software on IaaS or PaaS is your remote data processing, why third-party SaaS is treated like a component, what assurance evidence to collect, and contract terms with providers.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.