Plain-English guides to the EU Cyber Resilience Act.https://provetry.com/https://provetry.com/guides/provetry-vs-sbomify/https://provetry.com/guides/provetry-vs-sbomify/sbomify and Provetry compared for the Cyber Resilience Act: SBOM management, VEX and CSAF, trust center, the Article 14 reporting deadlines, hosting and prices.Fri, 13 Nov 2026 00:00:00 GMThttps://provetry.com/guides/provetry-vs-verimu/https://provetry.com/guides/provetry-vs-verimu/Verimu and Provetry compared for the Cyber Resilience Act: SBOM, exploited vulnerabilities, the Article 14 reporting deadlines, VEX, documents, plans and prices.Fri, 13 Nov 2026 00:00:00 GMThttps://provetry.com/guides/coordinated-vulnerability-disclosure-policy/https://provetry.com/guides/coordinated-vulnerability-disclosure-policy/What a coordinated vulnerability disclosure policy must say, why the CRA requires one, the timelines and safe harbour to decide, and how to publish it.Sun, 08 Nov 2026 00:00:00 GMThttps://provetry.com/guides/cra-annex-i-essential-requirements/https://provetry.com/guides/cra-annex-i-essential-requirements/Every essential requirement of the Cyber Resilience Act's Annex I, for the product and for vulnerability handling, with what it means in practice and how to show it.Sun, 08 Nov 2026 00:00:00 GMThttps://provetry.com/guides/cra-ce-marking-declaration-of-conformity/https://provetry.com/guides/cra-ce-marking-declaration-of-conformity/From 11 December 2027, products with digital elements need an EU declaration of conformity and the CE marking: what the declaration says, and where the marking goes.Sun, 08 Nov 2026 00:00:00 GMThttps://provetry.com/guides/cra-important-critical-products/https://provetry.com/guides/cra-important-critical-products/The full list of class I, class II and critical products in Annexes III and IV of the Cyber Resilience Act, and which conformity assessment route each one takes.Sun, 08 Nov 2026 00:00:00 GMThttps://provetry.com/guides/cvss-epss-kev-prioritise-vulnerabilities/https://provetry.com/guides/cvss-epss-kev-prioritise-vulnerabilities/Severity, probability and proof of exploitation: what CVSS, EPSS and the KEV catalogue each measure, how to combine them, and which one starts the CRA reporting clock.Sun, 08 Nov 2026 00:00:00 GMThttps://provetry.com/guides/cyber-resilience-act-nis2/https://provetry.com/guides/cyber-resilience-act-nis2/The Cyber Resilience Act covers products, NIS2 covers organisations. How the two EU laws differ, where they meet, and what to do when both apply to your company.Sun, 08 Nov 2026 00:00:00 GMThttps://provetry.com/guides/cyber-resilience-act-open-source/https://provetry.com/guides/cyber-resilience-act-open-source/When the Cyber Resilience Act applies to open-source software, who is exempt, what open-source stewards must do, and what manufacturers owe the projects they use.Sun, 08 Nov 2026 00:00:00 GMThttps://provetry.com/guides/cyber-resilience-act-saas/https://provetry.com/guides/cyber-resilience-act-saas/Pure SaaS is outside the Cyber Resilience Act, but the cloud back end of a product is not. What remote data processing means, with examples, and where NIS2 takes over.Sun, 08 Nov 2026 00:00:00 GMThttps://provetry.com/guides/cyber-resilience-act-timeline/https://provetry.com/guides/cyber-resilience-act-timeline/When the Cyber Resilience Act was adopted, what has applied since June and September 2026, what changes on 11 December 2027, and what is still to come.Sun, 08 Nov 2026 00:00:00 GMThttps://provetry.com/guides/cyclonedx-vs-spdx/https://provetry.com/guides/cyclonedx-vs-spdx/The two SBOM standards compared: origins, versions, what each describes well, VEX and licences, tools, and which one to pick for the Cyber Resilience Act.Sun, 08 Nov 2026 00:00:00 GMThttps://provetry.com/guides/provetry-vs-dependabot/https://provetry.com/guides/provetry-vs-dependabot/GitHub's Dependabot and Provetry compared for the Cyber Resilience Act: alerts, update pull requests, SBOM export, and what the CRA asks beyond them.Sun, 08 Nov 2026 00:00:00 GMThttps://provetry.com/guides/provetry-vs-dependency-track/https://provetry.com/guides/provetry-vs-dependency-track/OWASP Dependency-Track and Provetry compared for the Cyber Resilience Act: SBOM, exploited vulnerabilities, ENISA reporting, hosting, plans and cost.Sun, 08 Nov 2026 00:00:00 GMThttps://provetry.com/guides/provetry-vs-snyk/https://provetry.com/guides/provetry-vs-snyk/Snyk and Provetry compared for the Cyber Resilience Act: what each covers, SBOM and reachability, ENISA reporting, plans and prices.Sun, 08 Nov 2026 00:00:00 GMThttps://provetry.com/guides/sbom-docker-container-images/https://provetry.com/guides/sbom-docker-container-images/When a container image is part of a CRA product, and how to describe it: Syft, Trivy, BuildKit SBOM attestations, base images and OS packages.Sun, 08 Nov 2026 00:00:00 GMThttps://provetry.com/guides/sbom-dotnet-nuget/https://provetry.com/guides/sbom-dotnet-nuget/How to produce a Cyber Resilience Act SBOM for a .NET product: NuGet lock files, CycloneDX for .NET, Microsoft's SBOM tool, and the runtime you ship.Sun, 08 Nov 2026 00:00:00 GMThttps://provetry.com/guides/sbom-go/https://provetry.com/guides/sbom-go/How to produce a Cyber Resilience Act SBOM for a Go product: go.mod, cyclonedx-gomod, the build info inside binaries, the standard library and govulncheck.Sun, 08 Nov 2026 00:00:00 GMThttps://provetry.com/guides/sbom-java-maven-gradle/https://provetry.com/guides/sbom-java-maven-gradle/How to produce a Cyber Resilience Act SBOM for a Java, Kotlin or Scala product with the CycloneDX Maven and Gradle plugins, Spring Boot, and fat jars.Sun, 08 Nov 2026 00:00:00 GMThttps://provetry.com/guides/sbom-npm-javascript/https://provetry.com/guides/sbom-npm-javascript/How to produce a Cyber Resilience Act SBOM for a JavaScript or TypeScript product: which lock file counts, npm sbom, pnpm sbom, dev dependencies and bundles.Sun, 08 Nov 2026 00:00:00 GMThttps://provetry.com/guides/sbom-python/https://provetry.com/guides/sbom-python/How to produce a Cyber Resilience Act SBOM for a Python product: lock files, uv export, cyclonedx-py, the C libraries inside wheels and PEP 770.Sun, 08 Nov 2026 00:00:00 GMThttps://provetry.com/guides/sbom-rust-cargo/https://provetry.com/guides/sbom-rust-cargo/How to produce a Cyber Resilience Act SBOM for a Rust product: Cargo.lock, cargo-cyclonedx, cargo-auditable, -sys crates that bundle C code, and RustSec.Sun, 08 Nov 2026 00:00:00 GMThttps://provetry.com/guides/security-txt-cra-contact-point/https://provetry.com/guides/security-txt-cra-contact-point/What a security.txt file is, the RFC 9116 fields, an example, where to put it and how to keep it valid, and how it meets the Cyber Resilience Act's contact point duty.Sun, 08 Nov 2026 00:00:00 GMThttps://provetry.com/guides/what-is-an-sbom/https://provetry.com/guides/what-is-an-sbom/A software bill of materials explained: what it lists, the CycloneDX and SPDX formats, a short example, the minimum fields, and the tools that generate one.Sun, 08 Nov 2026 00:00:00 GMThttps://provetry.com/guides/what-is-the-cyber-resilience-act/https://provetry.com/guides/what-is-the-cyber-resilience-act/The EU Cyber Resilience Act in one read: what it covers, who must do what, the essential requirements, reporting to ENISA, the dates and the fines.Sun, 08 Nov 2026 00:00:00 GMThttps://provetry.com/guides/what-is-vex/https://provetry.com/guides/what-is-vex/Vulnerability Exploitability eXchange explained: the four statuses, the five justifications, the CSAF, CycloneDX and OpenVEX formats, an example, and how it fits the CRA.Sun, 08 Nov 2026 00:00:00 GMThttps://provetry.com/guides/cra-reporting-clock-24-72-hours-14-days/https://provetry.com/guides/cra-reporting-clock-24-72-hours-14-days/What starts the clock under Article 14 of the Cyber Resilience Act, what each report to ENISA must contain, and how to be ready before it happens.Sat, 07 Nov 2026 00:00:00 GMThttps://provetry.com/guides/does-the-cra-apply-to-your-product/https://provetry.com/guides/does-the-cra-apply-to-your-product/Scope, exclusions and product classes of the EU Cyber Resilience Act, explained for small software and device makers, with the dates that matter.Sat, 07 Nov 2026 00:00:00 GMThttps://provetry.com/guides/sbom-for-the-cyber-resilience-act/https://provetry.com/guides/sbom-for-the-cyber-resilience-act/What the Cyber Resilience Act asks of a software bill of materials, which format to choose, who sees it, and how to keep it current release after release.Sat, 07 Nov 2026 00:00:00 GMT