CRA vulnerability handling

CRA Annex I Part II: the eight vulnerability-handling requirements

Direct answer. Part II of Annex I to Regulation (EU) 2024/2847 is headed vulnerability handling requirements. It says manufacturers of products with digital elements shall: (1) identify and document vulnerabilities and components, including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies; (2) address and remediate vulnerabilities without delay, including by providing security updates, and, where technically feasible, provide new security updates separately from functionality updates; (3) apply effective and regular tests and reviews of the security of the product; (4) once a security update has been made available, share and publicly disclose information about fixed vulnerabilities, with a delay only in the duly justified cases the point describes; (5) put in place and enforce a policy on coordinated vulnerability disclosure; (6) facilitate sharing of information about potential vulnerabilities, including by providing a contact address for reporting vulnerabilities discovered in the product; (7) provide mechanisms to securely distribute updates so that vulnerabilities are fixed or mitigated in a timely manner and, where applicable for security updates, in an automatic manner; (8) ensure that, where security updates are available, they are disseminated without delay and, unless otherwise agreed for a tailor-made product, free of charge, accompanied by advisory messages. Article 13(8) says manufacturers shall ensure, when placing the product on the market and for the support period, that vulnerabilities are handled effectively in accordance with that Part II. Application dates are on the CRA timeline. This page is not legal advice.

CRALedger Duty Records (Shopify App Store · Write a review) tracks CRA product duties, product roles, checklists and open record gaps, Article 14 incident deadlines, encrypted ENISA SRP draft packs, vulnerability forwarding, and audit records. The listing does not say the app draws up a software bill of materials, publishes an advisory, or files a notification. The bill of materials is the SBOM page.

Related: EUDR Records Manager — DDS reference numbers on supplier lots.

Free check first: CRA role and scope self-check runs in your browser and sends nothing. Describe a product and your role and see which articles of Regulation (EU) 2024/2847 to read.

Checklist before you treat Part II as done

• Read points (1) to (8) of Annex I Part II on EUR-Lex. The SBOM sentence is point (1) only. The rest of the part is not an SBOM.
• Point (2) is “without delay”, including security updates, and separate from functionality updates where technically feasible. Point (8) is dissemination of those updates without delay, free of charge except the tailor-made agreement the point names, with advisory messages.
• Point (4) is public disclosure of fixed vulnerabilities after an update is available, with the delay the point allows when the manufacturer considers the security risks of publication to outweigh the benefits.
• Point (5) is a coordinated vulnerability disclosure policy. Point (6) includes a contact address for reporting.
• Article 13(8) ties that handling to the support period. The end date shown at purchase is the support-period product page. Article 14 reporting is a different article.

Points (1) to (8), in the annex’s order

The consolidated text opened for this page, CELEX 02024R2847-20241120, sets Part II out in this order. Confirm the live annex; the sentences below follow that text.

• (1) Identify and document vulnerabilities and components contained in products with digital elements, including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies of the products. Format and publication are the SBOM page. This page does not repeat them.
• (2) In relation to the risks posed to products with digital elements, address and remediate vulnerabilities without delay, including by providing security updates. Where technically feasible, new security updates shall be provided separately from functionality updates.
• (3) Apply effective and regular tests and reviews of the security of the product with digital elements.
• (4) Once a security update has been made available, share and publicly disclose information about fixed vulnerabilities, including a description, information allowing users to identify the affected product, the impacts, their severity, and clear and accessible information helping users to remediate them. In duly justified cases, where manufacturers consider the security risks of publication to outweigh the security benefits, they may delay making public information regarding a fixed vulnerability until after users have been given the possibility to apply the relevant patch.
• (5) Put in place and enforce a policy on coordinated vulnerability disclosure.
• (6) Take measures to facilitate the sharing of information about potential vulnerabilities in the product and in third-party components contained in that product, including by providing a contact address for the reporting of the vulnerabilities discovered in the product with digital elements.
• (7) Provide for mechanisms to securely distribute updates for products with digital elements to ensure that vulnerabilities are fixed or mitigated in a timely manner and, where applicable for security updates, in an automatic manner.
• (8) Ensure that, where security updates are available to address identified security issues, they are disseminated without delay and, unless otherwise agreed between a manufacturer and a business user in relation to a tailor-made product with digital elements, free of charge, accompanied by advisory messages providing users with the relevant information, including on potential action to be taken.

The support period, and what Article 14 is not

Article 13(8) opens: “Manufacturers shall ensure, when placing a product with digital elements on the market, and for the support period, that vulnerabilities of that product, including its components, are handled effectively and in accordance with the essential cybersecurity requirements set out in Part II of Annex I.” The same paragraph says: “Without prejudice to the second subparagraph, the support period shall be at least five years. Where the product with digital elements is expected to be in use for less than five years, the support period shall correspond to the expected use time.” How that end date is shown at purchase is Article 13(19), on the support-period product page. This page does not repeat that storefront job.

Article 14 is the reporting of actively exploited vulnerabilities and severe incidents. Deadlines and the notification path are CRA Article 14 incident deadlines. Importer and distributor forwarding is a separate page. When the obligations apply is the timeline, which follows Article 71 and the Commission’s Cyber Resilience Act page. This page does not restate those dates.

The Commission’s CRA standardisation page describes standard development under standardisation request M/606, and names vulnerability handling among the horizontal standards in that request. Read that page before treating any standard as giving a presumption of conformity. This page does not name one as adopted.

What this page is not

• Not legal advice, a vulnerability disclosure, or an SBOM for any product.
• Not a substitute for Annex I Part II or Article 13 of Regulation (EU) 2024/2847.
• Not the software bill of materials page. That URL is CRA software bill of materials.
• Not Article 14 reporting. That URL is CRA Article 14 incident deadlines.

Related pages

• CRA role and scope self-check — which articles to read for a role
• CRA software bill of materials — Annex I Part II, point (1)
• CRA Article 14 incident deadlines
• CRA support period on the product page — Article 13(19)
• CRA vulnerability forwarding — importer and distributor notice
• Cyber Resilience Act timeline
• Regulation (EU) 2024/2847, consolidated — Annex I Part II and Article 13
• European Commission: Cyber Resilience Act
• European Commission: CRA standardisation
• CRALedger Duty Records — live App Store listing
• Shopify apps hub
• Tools

Not legal advice. Confirm Annex I Part II, points (1) to (8), and Article 13 of Regulation (EU) 2024/2847 before you treat a process as meeting the vulnerability-handling requirements. The app tracks the duty records you enter. It does not draw up an SBOM or file an Article 14 notification.