Vulnerability Management
ENISA's Secure by Design Playbook: A CRA Guide
ENISA's Secure by Design and Default Playbook (final v1.0, July 2026) turns CRA rules into 22 practical checklists for SMEs, now also on GitHub.
Cyber Resilience Act Blog
Analysis and practical guidance on the EU Cyber Resilience Act. Regulation explainers, SBOM tooling, vulnerability workflows, and ENISA reporting, written for manufacturers, importers, and distributors.
Compliance
CRA Commission Guidance: What the March 2026 Draft Means
Archive of the March 2026 CRA consultation draft: 9 clarifications on SaaS, legacy products, open source, and reporting. The July draft now supersedes it.
Vulnerability Management
How to Generate a Firmware SBOM: Tools and Workflows
Generate a firmware SBOM using Yocto, Buildroot, EMBA, or Syft. ENISA vulnerability reporting starts September 11, 2026. Step-by-step workflows for CRA compliance.
Compliance
Cybersecurity Act 2 (CSA2): what CRA manufacturers should watch
CSA2 is still a proposal. COM(2026) 11 final would reshape cybersecurity certification, ICT supply chains and ENISA powers.
Compliance
Multi-Role CRA: Manufacturer, Importer, Distributor
CRA playbook for companies that manufacture, import and distribute: role mapping, obligation stacking, vulnerability routing, penalties and conflict points.
Vulnerability Management
RFC 9116 security.txt: required fields, location and example
Set up security.txt at /.well-known/security.txt: Contact, Expires, a copyable example and the CRA technical file link.
Stay in the loop
Get notified when we publish new articles about CRA compliance and product security.