The Cyber Resilience Act, SBOMs, and staying audit-ready. Written for small EU software vendors. RSS feed
Every CRAIR Snapshot now includes a downloadable CycloneDX JSON SBOM, on the free tier. Here's what's in the file and why it's the format procurement actually wants.
A procurement email lands: "send us your SBOM and current vulnerability status." For a lot of small software vendors that's a small panic. Here's what it means, and how to answer in an hour instead of a week.
No legalese, no fear-mongering. What the EU Cyber Resilience Act is, whether it applies to you, and the handful of things a small software vendor actually needs to do about it.
One concrete action, ten minutes, no cost, and it's the foundation everything else about CRA readiness stands on. Here's why.
A vulnerability report with 200 findings is worse than useless for compliance, it buries the few that actually matter. Here's the filter that separates them.
I told small software vendors they'd face €15M CRA fines. A standardisation expert corrected me: micro and small enterprises are exempt from fines for missing the 24-hour deadline. Here's the accurate picture, and why readiness still matters.
You can do a real chunk of Cyber Resilience Act preparation with free, open-source tools and public data. Here's the honest list, and where a paid tool actually saves you time.
SBOM is one of those acronyms that sounds more technical than it is. Here's what a Software Bill of Materials actually is, and why people suddenly want yours.
The small software companies most ready for the Cyber Resilience Act mostly didn't prepare because of it. They prepared because a customer made them. That tells you what really drives this.
Before I built a tool to check other people's software for CRA readiness, I pointed it at one of ours. The result was a useful kind of embarrassing.