Vulnerability Management
RFC 9116 security.txt: required fields, location and example
Set up security.txt at /.well-known/security.txt: Contact, Expires, a copyable example and the CRA technical file link.
Cyber Resilience Act Blog
Analysis and practical guidance on the EU Cyber Resilience Act. Regulation explainers, SBOM tooling, vulnerability workflows, and ENISA reporting, written for manufacturers, importers, and distributors.
Vulnerability Management
Generate an SBOM for CRA: Tools, Formats, CI/CD
A hands-on guide to generating Software Bills of Materials for CRA compliance. Covers open-source tools, format selection, and automated pipeline integration.
Compliance
CRA Distributor Checklist: 5 Verification Steps for Every Product
An operational CRA distributor companion: receiving checklist, quick-reference card, real scenarios, and the acts that turn a distributor into a manufacturer.
Compliance
CRA for Startups: Lean Compliance With One Engineer
How a resource-constrained startup meets the EU Cyber Resilience Act: self-assessment, one compliance owner, the support duty, and funding options.
Compliance
CRA and NIS2: Where the Two Regulations Overlap
Understanding how CRA and NIS2 interact. A practical guide for organizations that manufacture products and operate critical services.
Country & Market Guides
CRA vs UK PSTI: Compliance Guide for EU and UK Markets
Comparing the EU Cyber Resilience Act with the UK PSTI Act: key differences, where they overlap, and dual-compliance strategies for both markets.
Stay in the loop
Get notified when we publish new articles about CRA compliance and product security.