August 2026. The EU Cyber Resilience Act (CRA) affects software vendors and their customers in vital chains. Software Bill of Materials (SBOM) and vulnerability disclosure are becoming due diligence standard, alongside ISO 27001 and NIS2 questionnaires.
What does CRA ask in practice?
- SBOM: components, versions, licences, known vulnerabilities;
- security updates: patch timelines and customer communication;
- coordinated disclosure: process for report and fix;
- conformity documentation for critical products.
Link with ISO 27001
Secure development and vendor management (Annex A) partly cover CRA, but SBOM is more specific. Build SBOM generation in CI/CD; link to CRA and vendor management pages.
Enterprise procurement asks for SBOM in RFPs in 2026. Start with top products; expand per release. Document toolchain (Dependabot, Syft, CycloneDX).