Cyber Resilience Act reporting

Articles in this series, ordered by most recent update.

VEX Standards from First Principles
From software inventories and SBOM evidence to defensible, product-specific vulnerability-exploitability decisions, interoperable VEX exchange, lifecycle governance, and Cyber Resilience Act compliance across CISA, CSAF, CycloneDX, SPDX, and OpenVEX
cybersecurity
regulation and compliance
software systems
tutorial
πŸ‡¬πŸ‡§

A technical tutorial on SBOMs and Vulnerability Exploitability eXchange that explains how software inventories become product-specific exploitability decisions, how VEX information is represented and exchanged across CISA, CSAF, CycloneDX, SPDX, and OpenVEX, and how trust, lifecycle management, automation, interoperability, and regulatory obligations under the EU Cyber Resilience Act shape their practical use.

Antonio Montano
Dec 3, 2022
Modified Aug 22, 2026
Keywords SBOM, VEX, Vulnerability Exploitability eXchange, CISA, CSAF, CycloneDX, SPDX, OpenVEX, CVE-2021-44228, Log4Shell, Cyber Resilience Act, CRA, vulnerability management, software supply chain
Audiences analyst, practitioner, subject-matter-expert, technical specialist
Difficulty intermediate

A CVE Is Not an Article 14 Report: What Actually Makes a Vulnerability Reportable?
How to distinguish identifiers, severity scores, exploitation signals, product evidence, and the CRA reporting threshold
cybersecurity
regulation and compliance
πŸ‡¬πŸ‡§

A practical guide to deciding when a CVE, supplier advisory, KEV entry, scanner result, or zero-day becomes a mandatory vulnerability report under Article 14 of the Cyber Resilience Act.

Antonio Montano
Aug 17, 2026
Modified Aug 17, 2026
Keywords  
Audiences analyst, practitioner, subject-matter-expert, technical specialist
Difficulty intermediate

Does the CRA Require Vulnerability Scanning from 11 September 2026? No, but It Does Require a Reporting Decision Process
What manufacturers must have ready for Article 14, what customers can legitimately expect, and how scanners, SBOMs, telemetry, and threat intelligence fit
cybersecurity
regulation and compliance
πŸ‡¬πŸ‡§

A practical guide to CRA Article 14 from 11 September 2026: why vulnerability scanning is not a standalone legal duty, how manufacturers assess and report qualifying events, what customers can expect, and how security tools support the process in IT and OT.

Antonio Montano
Aug 16, 2026
Modified Aug 16, 2026
Keywords  
Audiences analyst, subject-matter-expert, technical specialist
Difficulty intermediate

Cyber Resilience Act: The New Product-Security Baseline
Scope, legal roles, secure design, conformity, reporting, and lifecycle assurance across the digital-product supply chain
cybersecurity
regulation and compliance
tutorial
πŸ‡¬πŸ‡§

A technical and legal analysis of the EU Cyber Resilience Act, explaining product scope, economic-operator roles, essential cybersecurity requirements, conformity assessment, component dependencies, vulnerability reporting, transition, and practical assurance governance.

Antonio Montano
Aug 3, 2026
Modified Aug 9, 2026
Keywords Cyber Resilience Act, CRA, Regulation (EU) 2024/2847, products with digital elements, cybersecurity regulation, EU product law, product security, secure by design, secure by default, cybersecurity risk assessment, essential cybersecurity requirements, vulnerability management, vulnerability handling, security updates, support period, software bill of materials, SBOM, remote data-processing solutions, RDPS, conformity assessment, CE marking, EU declaration of conformity, notified bodies, harmonised standards, important products with digital elements, critical products with digital elements, manufacturer obligations, importer obligations, distributor obligations, system integrators, economic operators, product lifecycle security, component due diligence, software dependencies, free and open-source software, FOSS, open-source software stewards, substantial modification, Article 14 reporting, actively exploited vulnerabilities, severe security incidents, ENISA, Single Reporting Platform, market surveillance, administrative fines, product liability, CRA compliance, cybersecurity assurance, procurement assurance, lifecycle governance, technical documentation, continuing conformity
Audiences analyst, executive, manager, subject-matter-expert, technical specialist
Difficulty intermediate
No matching items
Back to top