CRA Compliance Platform | SBOM, VEX & ENISA Reporting

Artifact Management

Your SBOMs, validated and versioned

Drop in a CycloneDX or SPDX file. We validate it against BSI TR-03183 quality criteria, score its completeness, and keep audit-ready records for every product version.

CycloneDX and SPDX Format is auto-detected on upload. CycloneDX 1.6 schema validation, SPDX 2.2+ parsing.

TR-03183 quality scoring Weighted metrics for PURL, hashes, supplier, license, and version completeness.

HBOM and VEX support Hardware Bill of Materials and Vulnerability Exploitability eXchange extraction from CycloneDX.

Dependency graph visualization Interactive Mermaid.js component tree with transitive dependency expansion and click-to-navigate.

Version comparison and drift detection Diff SBOMs between versions. Detect new, removed, and modified components.

VEX authoring Create and publish Vulnerability Exploitability eXchange statements directly in-app. Export as CycloneDX VEX.

CycloneDX SPDX HBOM VEX SARIF

Quality Score

Automatic scoring against BSI TR-03183 standard with improvement recommendations.

Dependency Tree

Visualize direct and transitive dependencies with circular dependency detection.

Version Diff

Compare SBOMs across versions. Track what changed and why.

License Check

Identify problematic license combinations across your components.

Vulnerability Scanning

Fresh CVE intelligence, on a documented cadence

Continuous monitoring surfaces new CVEs as they are disclosed and ranks them by real-world exploit risk, so your team fixes what matters first.

Hourly and daily syncs The CVE List (cvelistV5) is refreshed hourly; OSV.dev, CISA KEV, EPSS, and ENISA EUVD are refreshed daily.

Independent verification layer The scanner rechecks findings separately so missed detections in one source can still be caught.

EPSS-based prioritization Each finding is enriched with EPSS data so teams can focus on likely real-world exploitation, not just raw severity.

Automatic rescans and KEV cross-checks Production and staging versions are rescanned automatically, and findings are cross-referenced against the CISA KEV catalog.

Remediation tracking Five-stage lifecycle per vulnerability: start, fix, verify, release. Status tracking per affected version.

Suppression management Suppress false positives with justification, expiry dates, and approval workflows.

Reachability analysis Mark components as reachable or unreachable to prioritize what actually matters.

CSAF advisories Full advisory lifecycle: import, validate, publish. Draft to final with semantic diff.

Own Vulnerability Knowledge Base Five authoritative sources in one local knowledge base: cvelistV5, OSV.dev, CISA KEV, EPSS, and ENISA EUVD.

Automated VEX workflow and coverage tracking Triage decisions auto-generate draft VEX statements. Batch review and publish in one click, export CycloneDX VEX per version, and track coverage across all vulnerabilities.

Correlated vulnerability intelligence

Hourly CVE sync

Source CVE List (cvelistV5) Baseline CVE updates

Source OSV.dev Ecosystem-specific advisories

Source CISA KEV Known exploited vulnerabilities

Source EPSS Real-world exploit likelihood

Source ENISA EUVD EU coordinated vulnerability disclosures

Step 1 Aggregate and verify

Multiple intelligence feeds are correlated, then checked again through an independent scanner.

Step 2 Prioritize what matters

KEV and EPSS data surface the findings most likely to become real operational problems.

KEV matched EPSS prioritized

Output Verified findings move to action faster

Automatic rescans keep production and staging versions current while the workflow stays focused on active risk.

Technical Documentation

Compliance documentation, ready when requested

The CRA requires technical documentation to be kept for at least 10 years, or for the support period if that is longer. We generate the Annex VII packages, certificates, and compliance reports so market surveillance requests don't land cold.

Technical File Export

One ZIP with everything: machine-readable manifest (JSON), SBOMs (CycloneDX/SPDX), attestations, compliance checklist, and attribution reports.

EU Declaration of Conformity

Generate EU DoC documents with proper formatting, versioning, and CE marking tracking.

Compliance Reports

PDF or HTML. Vulnerability summary, component inventory, quality scores, and remediation status in one report you can hand to auditors.

Security Data Sheet

Annex II security datasheet wizard. Draft it, validate it, publish it. Export as PDF, Markdown, or HTML.

Certificates

Certificate lifecycle: draft, issue, revoke. Immutable issued certificates with downloadable PDF generation.

Multi-language Documents

Generate documents in the official EU languages your markets need.

Annex I Readiness

Score your product against CRA Annex I security requirements. Track what you've met and what's missing.

Artifact Signing

Sigstore-based signing for SBOMs and artifacts. Keyless and key-based modes with signature verification for supply chain integrity.

Support Period Tracking

Define and track product support periods, with alerts as they approach end-of-support.

ENISA Notifications

Track every ENISA deadline

The CRA has two reporting tracks with separate deadlines: vulnerabilities and severe incidents. We handle both with structured templates and countdown tracking.

24h

Early Warning

Early warning within 24 hours of becoming aware of an actively exploited vulnerability, sent to the CSIRT coordinator and ENISA. CVE ID, affected products, and attack complexity assessment.

72h

Detailed Notification

Technical analysis with remediation timeline, workarounds, and expanded impact assessment within 72 hours.

14d

Final Report

Resolution confirmation with permanent fix details, deployment timeline, and lessons learned. 14 days after a corrective measure is available for vulnerabilities, one month after the incident notification for incidents.

Deadline reminders Automatic alerts before each obligation expires

ENISA SRP ready Structured payloads for ENISA Single Reporting Platform. Day-one integration when API launches.

Submission history Full audit trail of all generated notifications and status tracking

Incident management Separate workflow for severe incidents. Final report one month after the incident notification vs. 14 days for vulnerabilities.

PDF reports & overdue alerts Early warning, detailed, and final report PDFs. Dashboard countdown when deadlines approach.

CSIRT coordination Simultaneous notification to ENISA and your national CSIRT.

Hardware & Firmware

Built for Products With Hardware Components

Machines, embedded systems, and IoT devices need more than software SBOMs. CRA Evidence supports the full hardware product lifecycle.

HBOM tracking Hardware Bill of Materials with 15 component types including sensors, actuators, and microcontrollers.

Firmware SBOM analysis Upload an SBOM from your firmware or hardware components and automatically check the embedded components listed in it for known CVEs.

CE marking workflow Track conformity assessment with full audit trail. Generate EU Declarations of Conformity.

Physical labeling Digital Product Passports with QR codes for hardware products.

Learn more about CRA compliance for machinery manufacturers

Built for Every CRA Role

Manufacturer, Importer & Distributor Dashboards

The CRA puts different obligations on manufacturers, importers, and distributors. Each role gets its own workspace with the workflows that actually matter to them.

Product & Version Management

Products organized by CRA category: Default, Important Class I/Class II, Critical. Each version tracks its release state, environment, and retention tier.

Full Artifact Pipeline

Upload SBOM, HBOM, and VEX per version. Quality scoring and vulnerability scanning kick in automatically.

Vulnerability & Incident Management

CVE tracking, remediation workflows, ENISA notifications. The security dashboard ranks everything by EPSS score and flags CISA KEV entries.

Technical File Generation

Annex VII export packages your evidence into a ZIP: SBOMs, compliance checklists, attribution reports, and conformity declarations.

Customer Notifications

Vulnerability notification system for downstream customers. Multi-language templates with distribution list management.

Trust Badges

Embeddable compliance trust badges for your product pages. Link to public verification of your CRA compliance status.

Conformity Assessment Tracking

Track the right conformity assessment route for each product category, from self-assessment to notified-body certification.

Digital Product Passports

Generate dynamic, publicly accessible Digital Product Passports for each version. QR codes, JSON-LD, and PDF export — multi-language and machine-readable.

Multi-Language Documents

Generate technical documentation, compliance reports, and Digital Product Passports in 8 EU languages.

Importer Verification Workflow

Step-by-step checklist covering importer duties: CE marking check, Annex II review, importer ID on product, EU DoC collected, final sign-off.

Manufacturer Registry

Keep track of your manufacturers: contacts, EU representatives, CVD/CSAF metadata. Set how often each one needs reverification.

Stop-Ship Decisions

Reason to believe a product is not in conformity? Block it and record your justification. If it poses a significant cybersecurity risk, notify the manufacturer and the market surveillance authorities. Actions are tracked.

Reverification Triggers

New vulnerability found? Major update released? Review date coming up? You'll get an alert to reverify.

Clone Verifications

Reviewing a new version of the same product? Clone the previous verification. Checklist state and manufacturer data carry over.

Verification Dashboard

See where everything stands at a glance: how many products are verified, pending, blocked, or due for reverification.

Distributor Due Care Checklist

The distributor due-care checks, in one list: product ID and traceability, CE marking, EU declaration, manufacturer contacts, anomaly detection.

CE Evidence Upload

Upload your CE marking evidence: photos, scans, certificates. File type and size checks are built in, and everything is audit-logged.

Verification Certificates

Generate PDF certificates proving due care compliance. Includes distributor details, scope, date, and unique verification number.

Stop-Ship Actions

Something's wrong? Stop distribution. The justification is recorded, and authorities and manufacturers are notified.

Portfolio View

See all your verifications in one place. Filter by status, product, or completion date to find what needs attention.

Compliance Progress

Visual progress bars per product. You can see at a glance how far along each verification is and what's left.

CI/CD & Automation

Fits into your build pipeline

There's a CLI and a REST API. Upload SBOMs, trigger scans, and gate releases from CI. Works with GitHub Actions, GitLab CI, or anything that can run a shell command.

CLI tool Upload SBOM/HBOM/VEX, scan, check status, manage releases, and compare versions from the terminal.

Severity fail thresholds Fail CI builds when critical or high vulnerabilities are detected. Configurable per pipeline.

Scoped API keys Fine-grained permissions: sbom:read, sbom:write, vuln:read, vuln:write, and more. Rate-limited and audited.

Webhooks Receive events for vulnerability discoveries, ENISA deadline warnings, and other compliance events.

Policy engine Policy-as-code rules for licenses, vulnerability thresholds, quality scores, and blocked components. Scope from global to per-version.

Release approval gates Configurable approval workflows before version releases. Manual gates and automated condition checks.

# Scan a Docker image and upload SBOM
$ docker run --rm \
-e CRA_EVIDENCE_API_KEY="cra_xxx" \
-v /var/run/docker.sock:/var/run/docker.sock \
craevidence/cli:latest \
upload-sbom \
--product my-app \
--version 2.1.0 \
--image my-app:2.1.0 \
--scan --fail-on high

Upload successful!

Product       my-app (created new)
Version       2.1.0 (created new)
Components    142
Quality Score 87%

Vulnerabilities
  Critical    0
  High        0
  Medium      3
  Low         1

GitHub Actions GitLab CI Jenkins Any CI

View full CI/CD integration guide

Integrations

Works with what you already use

Jira

Create issues for vulnerabilities directly

Slack

Automatic vulnerability and deadline alerts

GitHub

Security advisory sync and repo integration

Dependency-Track

Import SBOMs from existing instances

Microsoft Teams

Notifications in your Teams channels

ENISA Deadlines

Automated 24h, 72h, 14d/30d reminders

Supplier Portal

Customer-facing SBOM sharing with access control

Generic Webhook

Send events to any HTTP endpoint

Security & Trust

Built to be trusted with your compliance data

Access Control

Role-Based Access

Owner, Admin, Member, Viewer roles. Scoped API keys with fine-grained permissions.

SSO & MFA

SAML 2.0, Google & Microsoft OAuth, SCIM provisioning. TOTP multi-factor.

Data Protection

Encryption

AES-256 at rest, TLS 1.2 or higher in transit. Argon2id password hashing.

Multi-Tenancy

Tenant isolation by design: queries are scoped to the owning organisation.

Observability

Audit Logging

Full traceability of all actions. Queryable audit trail with CSV export.

Rate Limiting

Sliding window rate limiting on login, API, and upload endpoints.

Compliance

Content Security

Strict CSP headers, CSRF protection, HTML sanitization, and HSTS.

Long-Term Retention

Tier-based long-term retention, aligned with the CRA documentation duties your products carry.

Free Tools

Not sure if the CRA applies to you?

Figure out your obligations before signing up for anything. These tools are free and don't require an account.

CRA Applicability Checker 11-question wizard to determine if the Cyber Resilience Act applies to your product. Covers sector exemptions, connectivity requirements, and product classification.

CRA Role Quiz Find out whether you're a manufacturer, importer, or distributor under the CRA. Different roles have different obligations.

Shareable results Share your assessment results with colleagues or legal teams via unique URL. Available in all 8 European languages.

Try the CRA Applicability Checker Try Free CRA Quiz

No signup required. Takes about 2 minutes.

CRA Evidence Platform