[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:eu-cra\u002Foverview":3},{"item":4,"lessons":16,"controls":63,"related":92},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"eu-cra","overview","Article 11","Cyber Resilience Act (Regulation (EU) 2024\u002F2847)",13,"European Union","**What it asks for.** The Cyber Resilience Act sets horizontal cybersecurity requirements for products with digital elements placed on the EU market, covering hardware and software. Manufacturers must meet essential requirements on secure design and vulnerability handling, provide security updates for a support period, and carry out conformity assessment before CE marking. Reporting of actively exploited vulnerabilities and severe incidents applies from September 2026, with most other obligations from December 2027.\n\n**In practice.** Manufacturers classify their products, run risk assessments, adopt secure development practices, maintain software bills of materials, define support periods and set up coordinated vulnerability disclosure and reporting channels. Importers and distributors check that products comply. Evidence includes technical documentation, risk assessments, SBOMs and the EU declaration of conformity.\n\n**Common gaps.** Many manufacturers underestimate the vulnerability reporting duties and the effort to produce SBOMs across their portfolio. Open source dependencies and long support periods are frequent pain points.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2024\u002F2847\u002Foj","Read the CRA on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},11,[19,23,27,31,35,39,43,47,51,55,59],{"slug":20,"title":21,"published_at":22},"eu-cyber-resilience-act-activates-mandatory-vulnerability-reporting","EU Cyber Resilience Act Activates Mandatory Vulnerability Reporting","2026-10-01T12:20:17.746+00:00",{"slug":24,"title":25,"published_at":26},"eu-cyber-resilience-act-article-14-reporting-now-mandatory-for-digital-product-makers","EU Cyber Resilience Act Article 14 Reporting Now Mandatory for Digital Product Makers","2026-09-23T12:22:02.053+00:00",{"slug":28,"title":29,"published_at":30},"eu-cyber-resilience-act-mandates-24-hour-incident-reporting","EU Cyber Resilience Act Mandates 24-Hour Incident Reporting","2026-09-10T08:20:42.017+00:00",{"slug":32,"title":33,"published_at":34},"eu-cra-mandates-24-hour-vulnerability-disclosure-and-sboms-for-software-vendors","EU CRA Mandates 24-Hour Vulnerability Disclosure and SBOMs for Software Vendors","2026-09-08T22:22:14.449+00:00",{"slug":36,"title":37,"published_at":38},"open-source-at-a-crossroads-regulatory-pressure-forces-enterprise-accountability","Open Source at a Crossroads: Regulatory Pressure Forces Enterprise Accountability","2026-08-07T14:21:11.28+00:00",{"slug":40,"title":41,"published_at":42},"childrens-smartwatch-hijacked-to-track-spy-on-kids","Children's Smartwatch Hijacked to Track, Spy on Kids","2026-08-06T22:20:24.417+00:00",{"slug":44,"title":45,"published_at":46},"ai-enhanced-sast-and-cra-compliance-reshape-secure-development-practices","AI-Enhanced SAST and CRA Compliance Reshape Secure Development Practices","2026-07-16T00:20:21.313+00:00",{"slug":48,"title":49,"published_at":50},"building-effective-coordinated-vulnerability-disclosure-programs","Building Effective Coordinated Vulnerability Disclosure Programs","2026-07-15T16:22:19.34+00:00",{"slug":52,"title":53,"published_at":54},"sboms-become-essential-for-software-supply-chain-compliance","SBOMs Become Essential for Software Supply Chain Compliance","2026-07-15T14:20:22.868+00:00",{"slug":56,"title":57,"published_at":58},"ai-generated-code-accelerates-security-debt-faster-than-governance-can-keep-up","AI-Generated Code Accelerates Security Debt Faster Than Governance Can Keep Up","2026-07-13T10:21:24.776+00:00",{"slug":60,"title":61,"published_at":62},"binary-level-sbom-analysis-closes-critical-software-composition-blind-spots","Binary-Level SBOM Analysis Closes Critical Software Composition Blind Spots","2026-07-06T14:22:23.835+00:00",[64,69,73,78,83,88],{"slug":65,"name":66,"problem":67,"stories":68},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",5,{"slug":70,"name":71,"problem":72,"stories":68},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":74,"name":75,"problem":76,"stories":77},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",4,{"slug":79,"name":80,"problem":81,"stories":82},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",2,{"slug":84,"name":85,"problem":86,"stories":87},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",1,{"slug":89,"name":90,"problem":91,"stories":87},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[93,99,105,109,113,118,123,127],{"family":94,"item":95,"code":96,"title":97,"together":98},"cis","7","Control 7","Continuous Vulnerability Management",7,{"family":100,"item":101,"code":102,"title":103,"together":104},"nist-sp","800-218","SP 800-218","SP 800-218: Secure Software Development Framework (SSDF) Version 1.1",6,{"family":100,"item":106,"code":107,"title":108,"together":68},"800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",{"family":94,"item":110,"code":111,"title":112,"together":68},"2","Control 2","Inventory and Control of Software Assets",{"family":114,"item":115,"code":116,"title":117,"together":77},"gdpr","33","Article 33","Notification of a personal data breach to the supervisory authority",{"family":94,"item":119,"code":120,"title":121,"together":122},"17","Control 17","Incident Response Management",3,{"family":94,"item":124,"code":125,"title":126,"together":122},"16","Control 16","Application Software Security",{"family":128,"item":6,"code":129,"title":129,"together":122},"itil","ITIL"]