Product vulnerability management under the Cyber Resilience Act

What you will learn

• Read the eight vulnerability handling requirements of Annex I, Part II as one connected process rather than a checklist.
• Link each stage of that process to the related obligations of Article 13 and to the separate reporting track of Article 14.
• Place the process on the product lifecycle, from before placing on the market to the end of the support period.
• Allocate roles and build an evidence file, distinguishing what the text names from what is good practice.
• Explain what Annex I, Part II, point (1) and the Article 3 definition require of a software bill of materials, and what they leave open.
• Set up proportionate due diligence on third-party and free and open-source components under Article 13(5).
• Apply Article 13(6) when you find a vulnerability in an integrated component.
• Decide where the SBOM is kept and who receives it, based on Annex VII, Annex II and Article 13.

Programme

1. 1. Lesson 1 — From obligations to a vulnerability handling processHow Annex I, Part II, Article 13 and Article 14 fit together into one vulnerability handling process, who does what, and the evidence a manufacturer should keep.40 min
2. 2. Lesson 2 — Knowing what is in your product: components and the SBOMAnnex I, Part II, point (1) in practice: identifying components, building an SBOM, due diligence on third-party and open-source code, and reporting upstream.45 min
3. 3. Lesson 3 — Receiving, assessing and disclosing vulnerabilitiesCoordinated vulnerability disclosure, the reporting contact, security testing, triage and public disclosure of fixed vulnerabilities under Annex I, Part II of the CRA.50 min
4. 4. Lesson 4 — Remediation and security updates through the support periodRemediating vulnerabilities, shipping and distributing free security updates, setting and announcing the support period, and keeping updates available.45 min
5. 5. Lesson 5 — Reporting actively exploited vulnerabilities and severe incidentsAn Article 14 playbook: qualifying the event, the 24-hour, 72-hour and final reports, the competent CSIRT, informing users and delayed dissemination.50 min
6. 6. Lesson 6 — Running the process: roles, evidence and continuous improvementAssign roles, file vulnerability handling evidence in the technical documentation, support conformity assessment, work with authorities and improve over time.60 min