How to Evaluate CRA Compliance Software Beyond Checklists
A practical framework for evaluating CRA compliance software by lifecycle traceability, risk assessment, SBOM, vulnerability evidence, audit history and workflow fit.
Read articleAA-sec Resources
Practical guidance for secure, CRA-ready products.
Articles, guides, and technical resources for product teams building continuous security and traceable evidence.
Latest
Recent resources
CRA Alpha, Beta and Release-Candidate Software: Testing Rules Explained
The CRA allows unfinished alpha, beta and release-candidate software to be offered for testing under specific conditions. Learn what controls and evidence manufacturers should retain.
Read article
CRA Open-Source Software Exemption: When Commercial Activity Changes the Rules
The CRA does not give all open-source software a blanket exemption. Learn how commercial activity, responsibility and the steward role change the legal analysis.
Read article
CycloneDX vs SPDX for CRA SBOMs: How to Choose the Right Format
CycloneDX and SPDX can both support CRA SBOM workflows. Compare their data models, lifecycle fit, tooling and interoperability before choosing a release format.
Read article
CRA Coordinated Vulnerability Disclosure Policy: A Practical Manufacturer Guide
A practical guide for manufacturers building a CRA coordinated vulnerability disclosure policy, covering contact channels, intake, triage, researcher coordination, remediation, publication and evidence.
Read article
CRA Annex II User Information: What Manufacturers Must Provide
A practical manufacturer checklist for CRA Annex II user information, covering product identity, vulnerability contacts, support dates, secure-use instructions and release evidence.
Read articleSection
Cyber Resilience Act
Practical guidance on CRA scope, obligations, timelines, and product readiness.
CRA Open-Source Software Exemption: When Commercial Activity Changes the Rules
The CRA does not give all open-source software a blanket exemption. Learn how commercial activity, responsibility and the steward role change the legal analysis.
CRA Harmonised Standards in 2026: What Manufacturers Should Track
A practical guide to CRA harmonised standards in 2026, covering M/606 deliverables, Official Journal citation, presumption of conformity, and what manufacturers should track.
CRA Conformity Assessment Paths by Product Class
A practical guide to choosing the CRA conformity assessment route for default, Class I, Class II and critical products, including Modules A, B+C and H.
CRA Product Classification: Default, Class I, Class II and Critical
A practical guide to CRA product classification: how core functionality separates the default category from important Class I, Class II and critical products.
CRA Substantial Modification: When Changes Trigger New Duties
A practical guide to CRA substantial modification, including software updates, repairs, risk changes, manufacturer obligations, conformity assessment, and release evidence.
CRA Support Period Requirements and the Five-Year Rule
A practical guide to CRA support period requirements, including the five-year minimum, longer-lived products, shorter-use exceptions, documentation, and update retention.
Which Products with Digital Elements Are in Scope of the CRA?
A practical guide to deciding whether hardware, software, components and manufacturer-controlled remote processing fall within the Cyber Resilience Act, including common exclusions.
Cyber Resilience Act Readiness: A Practical Starting Point for Product Teams
A practical starting point for Cyber Resilience Act readiness, covering product scope, risk assessment, vulnerability handling, evidence, and reporting preparation.
Section
SBOM
Software bill of materials practices for product visibility and vulnerability response.
CycloneDX vs SPDX for CRA SBOMs: How to Choose the Right Format
CycloneDX and SPDX can both support CRA SBOM workflows. Compare their data models, lifecycle fit, tooling and interoperability before choosing a release format.
How to Generate and Maintain Release-Specific SBOMs in CI/CD
A practical CI/CD workflow for generating release-specific SBOMs, validating the result, binding it to the shipped artifact, and retaining evidence for later vulnerability work.
SBOM Quality: Completeness, Accuracy, and Release Traceability
A practical guide to improving SBOM quality through explicit completeness, reliable component identity, dependency accuracy, release binding, validation, and retained evidence.
SBOM Requirements Under the Cyber Resilience Act
A practical guide to CRA SBOM requirements, including minimum dependency coverage, machine-readable format, technical documentation, disclosure boundaries, and lifecycle maintenance.
Section
Vulnerability Management
Repeatable vulnerability intake, assessment, remediation, and disclosure workflows.
CRA Coordinated Vulnerability Disclosure Policy: A Practical Manufacturer Guide
A practical guide for manufacturers building a CRA coordinated vulnerability disclosure policy, covering contact channels, intake, triage, researcher coordination, remediation, publication and evidence.
How VEX Supports CRA Vulnerability Impact Decisions
A practical guide to using VEX for product-specific vulnerability impact decisions, with scoped status, supporting rationale, release traceability, and retained evidence for CRA readiness.
CRA Severe Incident: Definition and Reporting Trigger
A practical explanation of the CRA severe-incident threshold, the two Article 14 severity tests, reporting deadlines, user communication, and evidence to retain.
How to Build a CRA Vulnerability Handling Process
A practical guide to building a CRA vulnerability handling process that connects intake, triage, remediation, disclosure, updates, component coordination, and evidence.
CRA Security Update Requirements for Manufacturers
A practical guide to CRA security update requirements, covering remediation, secure distribution, automatic updates, user notices, availability, and release evidence.
What Counts as an Actively Exploited Vulnerability Under the CRA?
A practical guide to the CRA definition of an actively exploited vulnerability, the reliable-evidence threshold, awareness timing, and defensible triage records.
How to Prepare for the CRA Single Reporting Platform
A practical preparation guide for the CRA Single Reporting Platform, covering EU Login, assigned representatives, reporting data, evidence, and internal workflow.
CRA Vulnerability Reporting Requirements for Manufacturers
A practical explanation of CRA reporting duties for actively exploited vulnerabilities and severe incidents, including deadlines, routing, evidence, and preparation.
Section
Security Evidence
Traceable evidence that supports product security decisions and compliance work.
CRA Annex II User Information: What Manufacturers Must Provide
A practical manufacturer checklist for CRA Annex II user information, covering product identity, vulnerability contacts, support dates, secure-use instructions and release evidence.
Product Security Evidence Checklist for CRA Readiness
A practical CRA readiness checklist for product-security evidence, covering scope, risk assessment, SBOM, testing, vulnerability decisions, releases, user information and retention.
CRA Technical Documentation: What Manufacturers Need to Retain
A practical guide to CRA technical documentation, covering Annex VII evidence, risk assessment, vulnerability handling, test reports, retention and lifecycle updates.
Section
Product Security
Security engineering practices across product design, development, release, and maintenance.
CRA Alpha, Beta and Release-Candidate Software: Testing Rules Explained
The CRA allows unfinished alpha, beta and release-candidate software to be offered for testing under specific conditions. Learn what controls and evidence manufacturers should retain.
CRA Security Testing Requirements: What Effective and Regular Tests Should Evidence
A practical guide to designing effective and regular CRA security testing, selecting test depth by risk, and retaining evidence that supports product and vulnerability-handling decisions.
Known Exploitable Vulnerabilities Under the CRA: Release Gate Evidence
A practical guide to deciding whether a known exploitable vulnerability blocks CRA market placement, with product-specific triage, release-gate evidence, and documented decisions.
CRA Third-Party Component Due Diligence: What Manufacturers Need to Evidence
A practical guide to CRA third-party component due diligence, covering component selection, integration risk, vulnerability handling, support signals, and retained evidence.
How to Use ENISA's SME CRA Maturity Assessment
A practical guide to using ENISA's SME cyber-resilience maturity model to identify product-security gaps, prioritise improvements, and avoid treating a maturity score as proof of CRA compliance.
CRA Secure by Design and Default: Practical Engineering Guide
A practical guide to translating CRA secure-by-design and secure-by-default requirements into engineering actions, release evidence, and repeatable product-security checks.
How to Perform a CRA Cybersecurity Risk Assessment
A practical guide to CRA cybersecurity risk assessment, covering product scope, intended and foreseeable use, threats, Annex I mapping, evidence, and reassessment triggers.
Section
AA-sec Platform
Product updates and practical workflows supported by the AA-sec platform.
How to Evaluate CRA Compliance Software Beyond Checklists
A practical framework for evaluating CRA compliance software by lifecycle traceability, risk assessment, SBOM, vulnerability evidence, audit history and workflow fit.