CRA RESOURCES
The CRA, in your engineering workflow.
Practical guides for teams building software and connected products. Product scope, SBOMs, vulnerabilities, reporting and technical evidence.
A CRA implementation roadmap for product engineering teams
Turn CRA readiness into engineering tasks: product boundaries, security controls, SBOMs, reporting owners and release evidence.
SBOM in CI/CD: produce an inventory from the software you ship
A practical SBOM integration guide: choose build inputs, generate a machine-readable inventory, validate coverage and retain release evidence.
CRA Article 14 reporting: turn 24h and 72h deadlines into a runbook
Prepare CRA reporting owners, awareness timestamps, escalation paths, the ENISA reporting platform and final-report follow-up.
A vulnerability disclosure policy your product team can operate
Define a usable security contact, product scope, report requirements, acknowledgement process and coordinated disclosure workflow.
CRA technical documentation: build evidence from each release
Organise CRA engineering evidence around product versions, risk decisions, SBOMs, security tests and remediation records.
Does the CRA cover your SaaS or connected product? Start with the boundary
A technical scoping worksheet for software, firmware, companion apps and remote processing under the Cyber Resilience Act.