Guides
The Cyber Resilience Act, in plain English
Written for small teams without a compliance department. Each guide cites the articles of the regulation it relies on.
Basics · 7 min
The CRA and NIS2: who does what
The Cyber Resilience Act covers products, NIS2 covers organisations. How the two EU laws differ, where they meet, and what to do when both apply to your company.
Basics · 7 min
Cyber Resilience Act timeline: every date from 2022 to 2028
When the Cyber Resilience Act was adopted, what has applied since June and September 2026, what changes on 11 December 2027, and what is still to come.
Basics · 8 min
What is the Cyber Resilience Act? A plain-language summary
The EU Cyber Resilience Act in one read: what it covers, who must do what, the essential requirements, reporting to ENISA, the dates and the fines.
Scope · 9 min
Important and critical products under the CRA: classes and conformity
The full list of class I, class II and critical products in Annexes III and IV of the Cyber Resilience Act, and which conformity assessment route each one takes.
Scope · 8 min
The CRA and open source: maintainers, stewards and manufacturers
When the Cyber Resilience Act applies to open-source software, who is exempt, what open-source stewards must do, and what manufacturers owe the projects they use.
Scope · 6 min
The CRA and SaaS: when cloud software is in scope
Pure SaaS is outside the Cyber Resilience Act, but the cloud back end of a product is not. What remote data processing means, with examples, and where NIS2 takes over.
Scope · 8 min
Does the Cyber Resilience Act apply to your product?
Scope, exclusions and product classes of the EU Cyber Resilience Act, explained for small software and device makers, with the dates that matter.
Reporting · 9 min
CRA reporting: the 24-hour, 72-hour and 14-day clock explained
What starts the clock under Article 14 of the Cyber Resilience Act, what each report to ENISA must contain, and how to be ready before it happens.
SBOM · 7 min
CycloneDX or SPDX? Choosing an SBOM format
The two SBOM standards compared: origins, versions, what each describes well, VEX and licences, tools, and which one to pick for the Cyber Resilience Act.
SBOM · 8 min
What is an SBOM? Meaning, formats, an example and the tools
A software bill of materials explained: what it lists, the CycloneDX and SPDX formats, a short example, the minimum fields, and the tools that generate one.
SBOM · 7 min
SBOM for the Cyber Resilience Act: what to produce and how to keep it
What the Cyber Resilience Act asks of a software bill of materials, which format to choose, who sees it, and how to keep it current release after release.
Vulnerabilities · 8 min
Writing a coordinated vulnerability disclosure policy
What a coordinated vulnerability disclosure policy must say, why the CRA requires one, the timelines and safe harbour to decide, and how to publish it.
Vulnerabilities · 8 min
CVSS, EPSS and KEV: which vulnerability to fix first
Severity, probability and proof of exploitation: what CVSS, EPSS and the KEV catalogue each measure, how to combine them, and which one starts the CRA reporting clock.
Vulnerabilities · 6 min
security.txt and the CRA contact point for vulnerabilities
What a security.txt file is, the RFC 9116 fields, an example, where to put it and how to keep it valid, and how it meets the Cyber Resilience Act's contact point duty.
Vulnerabilities · 8 min
What is VEX? Saying a vulnerability does not affect you
Vulnerability Exploitability eXchange explained: the four statuses, the five justifications, the CSAF, CycloneDX and OpenVEX formats, an example, and how it fits the CRA.
Documentation · 7 min
CE marking and the EU declaration of conformity under the CRA
From 11 December 2027, products with digital elements need an EU declaration of conformity and the CE marking: what the declaration says, and where the marking goes.
Method · 12 min
CRA Annex I: the essential requirements, one by one
Every essential requirement of the Cyber Resilience Act's Annex I, for the product and for vulnerability handling, with what it means in practice and how to show it.
Ecosystems · 7 min
SBOM for Docker and container images under the CRA
When a container image is part of a CRA product, and how to describe it: Syft, Trivy, BuildKit SBOM attestations, base images and OS packages.
Ecosystems · 6 min
SBOM for .NET and NuGet projects under the CRA
How to produce a Cyber Resilience Act SBOM for a .NET product: NuGet lock files, CycloneDX for .NET, Microsoft's SBOM tool, and the runtime you ship.
Ecosystems · 6 min
SBOM for Go modules and binaries under the CRA
How to produce a Cyber Resilience Act SBOM for a Go product: go.mod, cyclonedx-gomod, the build info inside binaries, the standard library and govulncheck.
Ecosystems · 7 min
SBOM for Java: Maven and Gradle under the CRA
How to produce a Cyber Resilience Act SBOM for a Java, Kotlin or Scala product with the CycloneDX Maven and Gradle plugins, Spring Boot, and fat jars.
Ecosystems · 7 min
SBOM for npm, pnpm and Yarn projects under the CRA
How to produce a Cyber Resilience Act SBOM for a JavaScript or TypeScript product: which lock file counts, npm sbom, pnpm sbom, dev dependencies and bundles.
Ecosystems · 7 min
SBOM for Python projects: pip, Poetry and uv under the CRA
How to produce a Cyber Resilience Act SBOM for a Python product: lock files, uv export, cyclonedx-py, the C libraries inside wheels and PEP 770.
Ecosystems · 6 min
SBOM for Rust and Cargo projects under the CRA
How to produce a Cyber Resilience Act SBOM for a Rust product: Cargo.lock, cargo-cyclonedx, cargo-auditable, -sys crates that bundle C code, and RustSec.
Comparisons · 6 min
Provetry vs sbomify: which one for the CRA?
sbomify and Provetry compared for the Cyber Resilience Act: SBOM management, VEX and CSAF, trust center, the Article 14 reporting deadlines, hosting and prices.
Comparisons · 6 min
Provetry vs Verimu: which one for the CRA?
Verimu and Provetry compared for the Cyber Resilience Act: SBOM, exploited vulnerabilities, the Article 14 reporting deadlines, VEX, documents, plans and prices.
Comparisons · 6 min
Provetry vs Dependabot: is GitHub enough for the CRA?
GitHub's Dependabot and Provetry compared for the Cyber Resilience Act: alerts, update pull requests, SBOM export, and what the CRA asks beyond them.
Comparisons · 6 min
Provetry vs Dependency-Track: which one for the CRA?
OWASP Dependency-Track and Provetry compared for the Cyber Resilience Act: SBOM, exploited vulnerabilities, ENISA reporting, hosting, plans and cost.
Comparisons · 6 min
Provetry vs Snyk: a Snyk alternative for the CRA?
Snyk and Provetry compared for the Cyber Resilience Act: what each covers, SBOM and reachability, ENISA reporting, plans and prices.