[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNyH-NS_ywHqjYKP1kBndqt1k3cXqIB7NdbN8rHdigZ4":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":126},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"2de8a627-1a4e-43b3-bacc-81f71bba9a10","CRA Reporting Is Live: What Manufacturers, Vendors, and Distributors Need to Know","cra-reporting-is-live-what-manufacturers-vendors-and-distributors-need-to-know-76ef47","By Matthew Brady, Senior Security Engineering Manager, Black Duck As of September 11, 2026, Article 14 of the EU Cyber Resilience Act (CRA) is in force. Manufacturers, importers, and distributors of products with digital elements sold into the EU must notify ENISA or their national CSIRT within 24 hours of learning that a vulnerability is […] The post CRA Reporting Is Live: What Manufacturers, Vendors, and Distributors Need to Know appeared first on IT Security Guru.","As of September 11, 2026, Article 14 of the EU Cyber Resilience Act (CRA) requires manufacturers, importers, and distributors of products with digital elements sold into the EU to notify ENISA or their national CSIRT within 24 hours of learning about actively exploited vulnerabilities. Mitigation reports are due in 72 hours, and full analyses within two weeks. This initial milestone is part of broader secure development obligations set to arrive in December 2027, with potential penalties for non-compliance reaching up to 2.5% of global turnover or 15 million euros.","EU Cyber Resilience Act Article 14 reporting for product vulnerabilities is now in force.","https:\u002F\u002Fwww.itsecurityguru.org\u002F2026\u002F09\u002F23\u002Fcra-reporting-is-live-what-manufacturers-vendors-and-distributors-need-to-know\u002F?utm_source=rss&utm_medium=rss&utm_campaign=cra-reporting-is-live-what-manufacturers-vendors-and-distributors-need-to-know","https:\u002F\u002Fwww.itsecurityguru.org\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002FChatGPT-Image-Sep-23-2026-11_43_16-AM.png","2026-09-23T10:43:54+00:00","2026-09-23T12:00:24.239697+00:00",8,[17,20,23],{"name":18,"type":19},"Black Duck","vendor",{"name":21,"type":22},"open source software","technology",{"name":24,"type":22},"SBOM","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":25,"icon":27,"name":28,"slug":29},null,"Policy","policy",[31,36,41,43],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":42},{"id":25,"icon":27,"name":28,"slug":29},{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"ef42c16c-f41b-4794-8148-5fa5cb7b41b0","Cyber Resilience Act","eu-cyber-resilience-act",[],[18],{"controls":51,"vendors":125},[52,81,108],{"slug":53,"name":54,"problem":55,"products":56},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":82,"name":83,"problem":84,"products":85},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[86,94,100],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":95,"product_name":96,"url":98,"description":99},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"slug":109,"name":110,"problem":111,"products":112},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[113,119],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":114,"product_name":115,"url":117,"description":118},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":120,"product_name":121,"url":123,"description":124},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[],{"slug":127,"title":128,"body":129,"framework_refs":130,"framework_notes":143},"eu-cyber-resilience-act-article-14-reporting-now-mandatory-for-digital-product-makers","EU Cyber Resilience Act Article 14 Reporting Now Mandatory for Digital Product Makers","The EU Cyber Resilience Act (CRA) Article 14 introduces strict, time-bound disclosure obligations for manufacturers, importers, and distributors of products with digital elements — requiring notification to ENISA or a national CSIRT within 24 hours of discovering an actively exploited vulnerability. Many organizations in the hardware and software supply chain are unprepared for these tight deadlines, lacking the internal processes, tooling, or governance structures to detect, triage, and report vulnerabilities at this speed. Failure to comply carries severe financial penalties of up to 2.5% of global annual turnover or €15 million, making this a board-level risk. This regulation signals a fundamental shift: vulnerability disclosure is no longer voluntary or industry-led — it is a legal obligation with teeth, and organizations that treat security as an afterthought will face significant legal and reputational exposure.",[131,132,133,134,135,136,137,138,139,140,141,142],"EU Cyber Resilience Act (CRA) Article 14 — Vulnerability Reporting Obligations","EU Cyber Resilience Act (CRA) Article 13 — Obligations of Manufacturers","NIST SP 800-61 Rev. 2 — Computer Security Incident Handling Guide","NIST SP 800-218 — Secure Software Development Framework (SSDF)","CIS Control 7 — Continuous Vulnerability Management","CIS Control 17 — Incident Response Management","ISO\u002FIEC 29147:2018 — Vulnerability Disclosure","ISO\u002FIEC 30111:2019 — Vulnerability Handling Processes","ENISA Good Practice Guide on Vulnerability Disclosure","GDPR Article 33 — Notification of Personal Data Breaches (analogous timeline precedent)","ITIL 4 — Problem Management and Service Continuity practices","NIST CSF 2.0 — Respond (RS) and Govern (GV) Functions",{}]