SBOM and CRA

SBOMs for Cyber Resilience Act compliance

SBOMs are the operating map for CRA readiness. They help teams understand product components, monitor vulnerabilities, assess exploitability, and connect evidence to each product version.

Reviewed 2026-07-25Editorial owner: Cramio compliance team
CycloneDX
Interoperable component and dependency exchange
SPDX
Open standard for software package and license data
Per release
Freshness and product-version traceability matter more than a one-off export
Operating model

From obligation to auditable execution

1

Generate

Create an SBOM in the build pipeline from authoritative package, firmware, and supplier sources.

2

Validate

Check identity, versions, hashes, package URLs, dependency relationships, provenance, and completeness.

3

Monitor and decide

Correlate new vulnerability intelligence and document exploitability decisions using VEX-style evidence.

4

Remediate and prove

Connect fixes, mitigations, release evidence, disclosure decisions, and CRA reporting workflows.

01

Why SBOMs matter for CRA readiness

The Cyber Resilience Act requires teams to manage security across the product lifecycle. A current software bill of materials gives teams the dependency inventory needed to identify vulnerable products and prioritize remediation.

  • Map components, versions, package URLs, and product releases.
  • Connect CVEs and exploited vulnerabilities to affected product versions.
  • Support audit evidence for vulnerability handling and post-market monitoring.
Control outcomeEvery supported product release can be resolved to a current, attributable component inventory.
02

CycloneDX and SPDX ingestion

cramio supports common SBOM formats used by product security and DevOps teams. SBOMs can be uploaded through the dashboard or sent from CI/CD systems and custom scripts through authenticated APIs.

  • CycloneDX and SPDX JSON workflows for CI/CD pipelines.
  • Product-level SBOM history for version comparison and investigation.
  • Tenant-scoped storage and encryption for SBOM payloads and findings.
Control outcomeIngestion rejects malformed or cross-tenant data and retains a versioned source record for later verification.
03

Establish SBOM quality gates

Format compliance alone does not make an SBOM useful. Quality depends on component identity, version precision, dependency relationships, hashes, supplier data, timestamp, tool provenance, and coverage of first-party, third-party, firmware, and container layers relevant to the product.

  • Set minimum completeness thresholds by product and release risk.
  • Quarantine ambiguous component matches rather than creating false vulnerability conclusions.
  • Measure freshness, coverage, unresolved identity gaps, and time to regenerate after a release.
Control outcomeSecurity decisions use verified component identities and expose known inventory gaps instead of hiding them.
04

From SBOM to action

SBOMs are most valuable when they drive automated decisions. cramio uses SBOM metadata to power vulnerability monitoring, VEX statements, incident triage, reporting workflows, and evidence vault entries.

  • Detect whether a CVE maps to an actual product component.
  • Record not affected, affected, fixed, or under investigation decisions with VEX-style evidence.
  • Populate CRA report drafts with affected product and component facts.
Control outcomeEach vulnerability decision is attributable, time-bound, reviewable, and tied to the exact product and component versions assessed.
05

Use VEX to communicate product impact

A component match is the start of an investigation, not proof that a product is exploitable. VEX-style status and justification records allow teams to distinguish affected, not affected, fixed, and under-investigation cases while preserving the supporting rationale.

  • Require evidence and an expiry or review date for not-affected determinations.
  • Reopen decisions when product context or exploitation intelligence changes.
  • Share only the product-impact information appropriate for customers and supply-chain partners.
Control outcomeTeams reduce alert noise without losing the evidence needed to defend prioritisation and disclosure decisions.

Common questions

Do I need an SBOM for CRA compliance?

The CRA does not reduce to a single SBOM requirement, but SBOM coverage is a practical foundation for vulnerability monitoring, impact analysis, reporting, and lifecycle evidence.

Which SBOM formats does cramio support?

cramio supports CycloneDX and SPDX JSON workflows, including ingestion from dashboards, APIs, webhooks, and CI/CD pipelines.

Does cramio collect source code?

No. cramio is designed around SBOM metadata and vulnerability findings, not source code exfiltration.

Is an SBOM itself proof of CRA compliance?

No. An SBOM is a high-value evidence and operational input, but CRA readiness also requires risk management, secure development, vulnerability handling, documentation, reporting, and conformity activities.

Primary sources

This educational material supports operational readiness and is not legal advice. Customers remain responsible for determining how the CRA applies to their products and obligations.