🛡️ STATUS BADGE: 🟢 READY (Self-Hosted) | 🟢 ELIGIBLE (SaaS)
Executive Summary: What is it?
The EU Cyber Resilience Act (CRA) is a landmark regulation that introduces mandatory cybersecurity requirements for hardware and software products throughout their whole lifecycle. It applies to all products placed on the EU market.
CFO / Business Impact: What does it cost/risk?
- Legal Responsibility: Commercial OSS stewards are now legally liable for security maintenance and vulnerability disclosure.
- Transparency: Mandatory "Software Bill of Materials" (SBOM) increases supply chain visibility for enterprises.
Technical Reality: How does it work?
- Live SBOM: Software must provide a machine-readable inventory of all components (dynamic SBOM) that updates as dependencies change.
- 24-Hour Reporting: Exploited vulnerabilities must be reported to ENISA within 24 hours of discovery.