EU CRA: 12-Month Dev Roadmap for SBOM & Vulnerabilities (DEV-oriented)

#security #devsecops #devops #compliance

Goal: Turn the Cyber Resilience Act roadmap into a developer-first plan you can ship this year: SBOMs in CI, CRA developer checklist, EU 2024/2847 vulnerability reporting prep (Article 14), and a CE-ready conformity assessment evidence pack. You’ll also get real code to gate builds, collect artifacts, and run a quick external exposure sweep with our free security scanner.

Why now (dates that matter to builders):

11 June 2026 — Notified-body setup (Chapter IV) begins; you’ll need your conformity assessment path defined.
11 Sept 2026 — Manufacturers’ vulnerability & incident reporting obligations start (Article 14). Build your intake & triage workflows now.
11 Dec 2027 — CRA applies in full. Your product security, update policy, and evidence must be in place.

What the CRA actually expects from engineers (plain language)

Secure-by-design defaults: sensible configs, least privilege, hardening at install/first run.
Update policy & support period: declare how long you’ll ship security fixes; document auto-update behavior.
Vulnerability handling (Art. 14): intake → triage → remediate → communicate; keep records and notify via the single reporting platform when required.
Conformity assessment & CE marking path: pick the correct route (internal control / third-party as applicable), implement controls, and generate evidence (test reports, SBOMs, change logs, release notes, policy docs).

The 12-Month Cyber Resilience Act Roadmap (builder-centric)

Months 1–3 — Classify, declare support, start SBOM + risk gates

Classify products/components; define support period per product line.
Add SBOM generation (CycloneDX/Syft) to CI on every build.
Gate merges with OSV/CVE checks; set temporary thresholds (e.g., block Critical, warn High).

GitHub Actions — SBOM + OSV gate (multi-lang)

name: cra-sbom-and-vuln-gate
on: [push, pull_request]
jobs:
  sbom:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # Language setup examples (extend as needed)
      - uses: actions/setup-node@v4
        with: { node-version: '20' }
      - uses: actions/setup-python@v5
        with: { python-version: '3.12' }

      # Install Syft (SBOM) and OSV-Scanner
      - name: Install Syft
        run: curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
      - name: Install OSV-Scanner
        run: curl -sSfL https://raw.githubusercontent.com/google/osv-scanner/main/install.sh | sh -s -- -b /usr/local/bin

      # Build (your steps here)...

      # Generate SBOM (CycloneDX JSON) from workspace
      - name: Generate SBOM
        run: syft packages dir:. -o cyclonedx-json > sbom.cdx.json

      # Risk gate via OSV
      - name: Vuln Scan (OSV)
        id: osv
        run: |
          osv-scanner --sbom=sbom.cdx.json --format json > osv.json || true
          python - <<'PY'
import json, sys
d=json.load(open('osv.json'))
sev_map={'CRITICAL':4,'HIGH':3,'MODERATE':2,'MEDIUM':2,'LOW':1}
maxsev=0
for res in d.get('results',[]):
  for v in res.get('vulnerabilities',[]):
    s=v.get('severity',[])
    for it in s:
      maxsev=max(maxsev, sev_map.get(it.get('type','').upper(),0))
if maxsev>=4:
  print("Found CRITICAL vulns — blocking build"); sys.exit(1)
elif maxsev>=3:
  print("Found HIGH vulns — failing as per CRA gate"); sys.exit(1)
print("No high/critical vulns — allowed")
PY
      - uses: actions/upload-artifact@v4
        with: { name: "cra-evidence-sbom-osv", path: |
          sbom.cdx.json
          osv.json
        }

GitLab CI — minimal variant

stages: [build, security]
sbom_and_gate:
  stage: security
  image: alpine:3.20
  script:
    - apk add --no-cache curl python3
    - curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
    - curl -sSfL https://raw.githubusercontent.com/google/osv-scanner/main/install.sh | sh -s -- -b /usr/local/bin
    - syft dir:. -o cyclonedx-json > sbom.cdx.json
    - osv-scanner --sbom=sbom.cdx.json --format json > osv.json || true
    - python3 - <<'PY'
import json,sys
d=json.load(open('osv.json')); sev=0
for r in d.get('results',[]):
  for v in r.get('vulnerabilities',[]): 
    for s in v.get('severity',[]): 
      if s.get('type','').upper() in ('CRITICAL','HIGH'): sys.exit(1)
PY
  artifacts:
    when: always
    paths: [sbom.cdx.json, osv.json]

NPM quick gate

// package.json
{
  "scripts": {
    "prebuild": "npm audit --audit-level=high"
  }
}

Python quick gate

pip install pip-audit
pip-audit --strict  # non-zero exit if vulnerable

Months 4–6 — CVD workflow + patch SLAs + communication

Publish SECURITY.md and /.well-known/security.txt so researchers/customers know how to report.
Stand up an intake endpoint (ticketing or API), triage policy, and patch SLAs by severity.
Prebuild notification templates (release notes, advisories) to speed Article 14 reporting.

SECURITY.md (repo root)

# Security Policy (CRA Developer Checklist)
## Supported Versions (Support Period)
- v3.x: Security fixes until 2028-12-31
- v2.x: Security fixes until 2027-06-30

## Reporting a Vulnerability
- Email: security@yourco.example
- PGP: https://yourco.example/pgp.txt
- Web: https://yourco.example/vuln-report
We triage within 2 business days. High/Critical patched or mitigated within 30 days.

/.well-known/security.txt

Contact: mailto:security@yourco.example
Encryption: https://yourco.example/pgp.txt
Policy: https://yourco.example/security
Acknowledgements: https://yourco.example/hall-of-fame
Preferred-Languages: en

Minimal vuln-intake API (Express.js)

import express from "express";
import rateLimit from "express-rate-limit";
import Joi from "joi";

const app = express();
app.use(express.json());
app.use(rateLimit({ windowMs: 15*60*1000, max: 60 }));

const schema = Joi.object({
  product: Joi.string().required(),
  version: Joi.string().required(),
  summary: Joi.string().max(5000).required(),
  impact: Joi.string().valid("LOW","MEDIUM","HIGH","CRITICAL").required(),
  poc_url: Joi.string().uri().optional(),
  contact_email: Joi.string().email().required()
});

app.post("/vuln-report", async (req, res) => {
  const { error, value } = schema.validate(req.body, { abortEarly: false });
  if (error) return res.status(400).json({ errors: error.details.map(d=>d.message) });
  // TODO: create ticket, notify on-call, store evidence
  res.status(202).json({ status: "received", ref: crypto.randomUUID() });
});

app.listen(8080, () => console.log("Intake listening on :8080"));

Months 7–12 — Evidence pack for CE marking path

Freeze conformity scope; map essential requirements → controls/tests.
Automate evidence capture: SBOMs, vuln scans, test results, change control, release notes, disclosure logs.
Dry-run a conformity assessment and create your EU Declaration of Conformity (DoC) draft.

Bash: collect CRA evidence artifacts

#!/usr/bin/env bash
set -euo pipefail
OUT="cra_evidence_$(date +%Y%m%d%H%M%S)"
mkdir -p "$OUT"
cp sbom.cdx.json "$OUT"/ || true
cp osv.json "$OUT"/ || true
cp -r test-reports "$OUT"/ || true
cp -r docs/policies "$OUT"/ || true
cp CHANGELOG.md "$OUT"/ || true
cp SECURITY.md "$OUT"/ || true
zip -r "${OUT}.zip" "$OUT"
echo "Evidence bundle: ${OUT}.zip"

Skeleton: EU Declaration of Conformity (markdown you can export to PDF)

# EU Declaration of Conformity — Products with Digital Elements
**Manufacturer:** YourCo Ltd., Address, Country  
**Product/Model:** WidgetOS v3  
**Regulation:** (EU) 2024/2847 (Cyber Resilience Act)  
**Assessment Route:** [Internal control / Third-party]  
**References:** Test reports, SBOMs, vulnerability handling records, update policy, support period declaration.  
We declare the product conforms with the essential cybersecurity requirements of Annex I.  
Place/Date, Authorized Signatory, Title

Bonus: Quick external exposure sweep (free tool)

Before the assessment, run a fast exposure check on your web apps/sites.

➡ Scan with our free Website Vulnerability Scanner:

Screenshot of the free tools webpage where you can access security assessment tools.

If findings pop up, our teams can help with risk assessments and remediation:

Risk Assessment Services — audit-ready gaps & roadmap.
Remediation Services — turn findings into fixes with evidence.

(Also see specialized pages for SOC 2 and ISO 27001 programs if they’re in scope for you.)
https://www.pentesttesting.com/soc-2-remediation-services/ • https://www.pentesttesting.com/iso-27001-remediation-services/

CRA Developer Checklist (copy/paste)

[ ] Product classification complete; support period declared in docs and product UI.
[ ] SBOM produced per build (CycloneDX JSON); stored as artifact.
[ ] Risk gate in CI (block Critical/High); waiver workflow documented.
[ ] Security updates policy + auto-update behavior documented.
[ ] CVD/Disclosure: SECURITY.md + security.txt; intake API; triage SLAs.
[ ] Incident/vulnerability reporting runbook aligned to CRA (Article 14).
[ ] Change control + release notes templates with CVE sections.
[ ] Evidence pack script and DoC draft ready; roles trained.
[ ] Mock conformity assessment completed; gaps remediated.
[ ] External exposure sweep archived (free scanner report attached).

Code: turn SBOM into actionable tickets (Python)

# parse CycloneDX SBOM, open tickets for high/critical via your API
import json, requests, os
SEVERITY = {"CRITICAL":4,"HIGH":3}
SBOM="sbom.cdx.json"
TICKETS_API=os.getenv("TICKETS_API","https://tickets.example/api/new")
with open(SBOM) as f:
    data=json.load(f)
issues=[]
for comp in data.get("components",[]):
    for vuln in (comp.get("vulnerabilities") or []):
        for rating in vuln.get("ratings",[]):
            if SEVERITY.get(rating.get("severity","").upper(),0)>=3:
                issues.append({
                   "title": f"{comp.get('name')} {vuln.get('id')}",
                   "severity": rating.get("severity"),
                   "package": f"{comp.get('purl')}"
                })
for i in issues:
    r=requests.post(TICKETS_API,json=i,timeout=10)
    r.raise_for_status()
print(f"Raised {len(issues)} tickets")

Sample report to check Website Vulnerability — findings overview:

Sample vulnerability assessment report generated with our free tool, providing insights into possible vulnerabilities.

Code: release advisory template (auto-filled)

#!/usr/bin/env bash
TAG=${1:? "tag required, e.g. v3.4.2"}
DATE=$(date +%F)
cat > "advisory-${TAG}.md" <<EOF
# Security Advisory for ${TAG}
**Date:** ${DATE}
**Affected:** WidgetOS <= ${TAG}
**Impact:** High
**CVE(s):** CVE-XXXX-YYYY
**Summary:** Fixes for third-party libs and auth bypass edge case.
**Mitigation:** Update to ${TAG} or later. Workaround: disable legacy SSO mode.
**Support period:** Security fixes provided until 2028-12-31.
EOF