EU Cyber Resilience Act Checklist
The EU Cyber Resilience Act Checklist pairs each CRA obligation that runs through a vulnerability management program with the DefectDojo capability that answers it, and shows which edition covers it. With Article 14 reporting in effect since September 11, 2026 and the Annex I requirements applying from December 11, 2027, it is a planning tool for product security and PSIRT teams.
The EU Cyber Resilience Act Checklist will cover:
- Annex I, Part II vulnerability handling, from SBOMs of top-level dependencies to coordinated vulnerability disclosure and security updates
- Article 14 reporting for actively exploited vulnerabilities and severe incidents, with the 24-hour, 72-hour and final report deadlines
- Product security and due diligence under Annex I, Part I and Article 13, including third-party components and 10 years of technical documentation
Get the paper
Tell us where to send it. The download link appears here as soon as you submit.