What is the CRA
The EU Cyber Resilience Act is a regulation requiring software manufacturers to manage security vulnerabilities systematically. It applies to any company placing software on the EU market, whether free or commercial. Enforcement begins in 2027.
For manufacturers of products with digital elements — including SaaS, containerized applications, and libraries — the CRA mandates two critical practices: maintaining a software bill of materials (SBOM) and reporting actively exploited vulnerabilities to national competent authorities without undue delay.
CRA Article 14 — Key Requirements
Article 14 outlines the core obligations for product manufacturers:
Maintain an SBOM
Document every component (dependency) in your product. The SBOM must be cryptographically signed and kept current.
Report Vulnerabilities
When an actively exploited vulnerability is discovered, notify the relevant national competent authority within 24 hours of becoming aware of it.
Systematic Handling
Establish a documented process for identifying, triaging, fixing, and releasing patches for vulnerabilities throughout the product lifecycle.
Lifecycle Coverage
Security obligations apply from the moment you first place a product on the market through its end of support.
How Werfty Helps
Werfty is purpose-built to satisfy CRA Article 14 requirements. Each Werfty component maps directly to a compliance obligation:
SBOM Generation & Attestation
werfty-generate produces a CycloneDX-format SBOM for your Docker image or Python package. werfty-attest signs it with cosign and stores it as an OCI attestation — cryptographically tamper-proof and verifiable by any auditor.
CRA mapping: Satisfies SBOM maintenance requirement with non-repudiation through cosign signatures.
Verifiability & Auditability
werfty-verify allows any third party — an auditor, regulator, or security researcher — to independently confirm that an attestation is genuine and has not been altered. Verification uses only public keys and OCI registry access; no special credentials required.
CRA mapping: Enables demonstrable compliance and third-party verification of SBOM integrity.
Structured Vulnerability Triage
werfty-triage automatically scans your SBOM against known vulnerability databases and produces a structured triage report. Critically, it enforces a human review gate before any suppression — no vulnerability is silently ignored. This audit trail demonstrates systematic, intentional handling.
CRA mapping: Proves systematic vulnerability handling with an immutable audit trail.