4 Vulnerability Handling Process

The CRA requires that manufacturers identify and document all dependencies and vulnerabilities, provide a software bill of materials (SBOM), and track these items continuously, while verifying that no known vulnerabilities remain and any dependencies and vulnerabilities which surface must be addressed without delay. Manufacturers must test the security of the digital product, publicly disclose information about fixed vulnerabilities, maintain a coordinated vulnerability disclosure policy, facilitate sharing of potential vulnerability data, and deliver patches promptly, free of charge, with advisory messages.