Engineering Blog

CVD Portal Engineering

Technical insights on coordinated vulnerability disclosure, CRA compliance, and product security engineering.

CRA Compliance2026-07-2911 min read

The ETSI EN 304 Series: One CRA Standard Per Annex III Product Category

Everyone tracking CRA standardisation is watching the horizontal prEN 40000 series. The other half of standardisation request M/606 is 18 vertical standards, EN 304 617 to EN 304 642, one per Annex III product category, and ETSI has public drafts out for most of them. Here is the full mapping, the categories ETSI is not covering, and why none of it changes your Article 32 route yet.

By The CVD Portal Team

CRA Compliance2026-07-279 min read

Every Worked Example in the Commission's CRA Guidance, and What Changed From the Draft

C(2026) 5252 carries 67 numbered examples and 5 remote data processing use cases. Fourteen of them are new since the consultation draft and one was deleted. Here is what the additions tell you about where the Commission thinks manufacturers are getting it wrong.

By The CVD Portal Team

CRA Compliance2026-07-2712 min read

The Commission's CRA Guidance: Reading the Four-Factor Test and the Support Period Rules

C(2026) 5252 gives manufacturers two things they have been working without. A four-factor test for whether a software update is a substantial modification, and a clear statement that five years of support is a floor rather than a default. This walks through both using the Commission's own worked examples.

By The CVD Portal Team

CRA Compliance2026-07-228 min read

What an Empty Risk Assessment Leaves Out

A CRA risk assessment has to be the manufacturer's own determination, which is the strongest argument for starting from an empty document. The trouble is what an empty document selects for. Teams write down the threats they already discuss and leave out the interface nobody owns, the decommissioning path, and the failure that only appears at fleet scale. What a starting draft is for, and the one property it needs to stay safe.

By The CRA Portal Team

CRA Compliance2026-07-217 min read

Your CRA Technical File Is Mostly Written Already

Most manufacturers approaching the CRA technical file treat it as a writing project. It is a mapping project first. Annex VII asks you to demonstrate that specific evidence satisfies specific essential requirements, and the architecture diagrams, test reports and user documentation that demonstrate them usually already exist. Here is why the mapping is the hard part, and why a gap list computed before mapping measures the wrong thing.

By The CRA Portal Team

Technical Deep Dive2026-07-207 min read

Your CRA Evidence Already Lives in Jira: Importing It Instead of Rewriting It

Annex VII asks for records of work that engineering teams already produce, in tickets and wiki pages. Most compliance tooling asks you to transcribe that record into a second set of documents, which then starts decaying immediately. CVD Portal now reads Jira and Confluence directly, so the technical file is built from the systems where the work actually happened.

By The CVD Portal Team

CRA Compliance2026-07-178 min read

Keeping CRA Documentation Up to Date: What the Regulation Actually Requires

The CRA makes the technical file, the risk assessment and the EU Declaration of Conformity living documents. Article 31(2) says continuously updated, Article 13(3) says updated during the support period, and market surveillance can ask for the file a decade later. Here are the update duties, the events that trigger them, and a cadence that survives an inspection.

By The CVD Portal Team

Technical Deep Dive2026-07-179 min read

Running the CRA Risk Assessment in Practice: CVD Portal and Draft prEN 40000-1-2

Article 13 requires a documented cybersecurity risk assessment, and the draft European standard prEN 40000-1-2 describes the process a manufacturer should run to produce one. This post walks through how that process works in CVD Portal's products workspace, from product context and risk acceptance criteria to the Annex I applicability table, and maps every step to the regulation and to the draft standard's clauses.

By The CVD Portal Team

CRA Compliance2026-07-168 min read

What the New Joint CISA CVD Guidance Means for CRA Manufacturers

Five national cyber agencies published a joint guide on working with security researchers. It reads like a checklist for the CRA's vulnerability handling requirements. Here is the mapping, and what to do about each recommendation.

By Porta Regulus BV

CRA Compliance2026-07-168 min read

Running a Bug Bounty Programme Alongside Your CVD Process

Bug bounties pay researchers for valid reports. The CRA does not require them, but it does require a coordinated vulnerability disclosure policy. Here is how the two approaches relate, what CVD Portal provides as the disclosure layer, and how AI triage keeps up when report volume grows.

By Porta Regulus BV

CRA Compliance2026-07-108 min read

Annex II in Practice: The User Information the CRA Makes You Publish

Annex II of the Cyber Resilience Act prescribes the information and instructions every product with digital elements must ship with, from the vulnerability reporting contact to the support period end date. Here is each required item with practical examples, where the information must live, and the mistakes market surveillance will notice first.

By The CVD Portal Team

CRA Compliance2026-07-108 min read

CE Marking Under the Cyber Resilience Act: What Changes for Manufacturers

From 11 December 2027 the CE mark on a product with digital elements attests cybersecurity conformity. Here are the Article 30 affixing rules, when a notified body number must accompany the mark, the sequence that must be complete before you affix it, and what market surveillance does about a wrongly marked product.

By The CVD Portal Team

Technical Deep Dive2026-07-108 min read

The CRA Cybersecurity Risk Assessment: A Working Methodology

Article 13 makes a documented cybersecurity risk assessment the foundation of every CRA conformity claim. Here is a working methodology, from STRIDE threat modelling per component and data flow to likelihood and impact scoring, and how the results decide which Annex I requirements apply.

By The CVD Portal Team

CRA Compliance2026-07-109 min read

The Complete CRA Guide for SMEs: Every Obligation in One Place

A single walkthrough of every Cyber Resilience Act obligation for a small manufacturer, from the first scope check through classification, Module A self-assessment, documentation, and CE marking to the reporting duties that begin on 11 September 2026.

By The CVD Portal Team

CRA Compliance2026-07-108 min read

The CRA Support Period: How to Determine It and Where You Must State It

Article 13(8) of the Cyber Resilience Act requires every product with digital elements to carry a support period that reflects how long the product will actually be used, with a five-year floor in most cases. Here is how to determine the period, where the end date must be stated, and which duties run while it lasts.

By The CVD Portal Team

CRA Compliance2026-07-108 min read

Does the CRA Apply to Your Product? A Scope Decision Walkthrough

Article 2 decides whether the Cyber Resilience Act covers your product at all. This walkthrough works through the connectivity criterion, the sectoral exclusions, the spare parts exemption, the open-source commercial activity test, and the SaaS boundary, ending in a stepwise decision sequence.

By The CVD Portal Team

CRA Compliance2026-07-108 min read

Drafting the EU Declaration of Conformity: A Field-by-Field Walkthrough

The EU Declaration of Conformity is the document in which you assume legal responsibility for your product's CRA conformity. Here is every Annex V element in order, who signs it, when it must exist, how the simplified web-link version works, and how to keep it valid for the ten years the regulation demands.

By The CVD Portal Team

Technical Deep Dive2026-07-109 min read

From Risk Assessment to Technical File: How the CRA Artifacts Chain Together

The CRA's documents are not a checklist of independent deliverables. Classification decides your route, the risk assessment decides which requirements apply, evidence rolls up into the Annex VII file, the DoC asserts what the file proves, and Annex II publishes the user-facing slice. Here is the dependency chain and how to keep it consistent.

By The CVD Portal Team

CRA Compliance2026-06-259 min read

Inside the SRP Reporting Form: The Data Fields You Need at 24h, 72h, and Final

ENISA has published the data fields its Single Reporting Platform will collect at each stage of a CRA notification. Here is the full field map for vulnerabilities and incidents, what is mandatory when, and why the staged design rewards preparation.

By The CVD Portal Team

CRA Compliance2026-06-256 min read

Voluntary Reporting on the SRP: What the Platform Accepts Beyond Mandatory Notifications

The Single Reporting Platform is built for mandatory CRA notifications, but it will also accept voluntary reports from anyone, covering vulnerabilities, cyber threats, incidents, and near misses. Here is who can use it, what it accepts, and when the function turns on.

By The CVD Portal Team

CRA Compliance2026-06-169 min read

The Clock Is Ticking: What Dutch Executives Need to Know Before the Cyberbeveiligingswet Takes Effect

The Netherlands missed the NIS2 transposition deadline by nearly two years. Now the Cyberbeveiligingswet has cleared the House of Representatives and the government is targeting entry into force on 1 July 2026. Four enforcement-facing obligations, including personal director liability, are about to change how Dutch boards operate.

By The CVD Portal Team

CRA Compliance2026-06-168 min read

The Overlapping Notification Clocks: CRA, NIS2 and GDPR in One View

One security event can start three legal clocks at once. The CRA, NIS2 and GDPR each demand notification on their own deadline, to their own authority, in their own format. Here is how the obligations overlap and why a manufacturer needs a single place to track them.

By The CVD Portal Team

CRA Compliance2026-06-029 min read

When Vulnerability and Incident Reporting Become Mandatory Under the CRA

The CRA's reporting obligations do not switch on with the rest of the regulation. Article 14 applies from 11 September 2026, ahead of full conformity in December 2027, and it binds manufacturers the moment a product becomes actively exploited. Here is exactly when the duty begins and who it binds.

By The CVD Portal Team

CRA Compliance2026-06-0210 min read

Which Vulnerabilities and Incidents Must Be Reported, and Which Do Not

Most vulnerabilities a manufacturer handles never trigger a report to authorities. The CRA's Article 14 duty is narrow: actively exploited vulnerabilities and severe incidents affecting product security. Here is how to tell what is in scope, with worked examples and a decision framework.

By The CVD Portal Team

CRA Compliance2026-06-019 min read

Understanding Reporting Timelines and Follow-Up Obligations

Article 14 is a three-stage cascade: a 24-hour early warning, a 72-hour detailed notification, and a final report within 14 days or one month. Here is what each stage must contain, when the clock starts, and the follow-up duties that continue after the final report.

By The CVD Portal Team

CRA Compliance2026-06-019 min read

How Reporting to ENISA and National Authorities Is Organised

When an Article 14 event occurs, a manufacturer does not file with a single regulator. The CRA routes reports through a single platform to ENISA and the relevant national CSIRT at once. Here is how that architecture works, who receives what, and how onward notification flows.

By The CVD Portal Team

CRA Compliance2026-05-315 min read

Open Bug Bounty vs CVD Portal: What is the Difference?

Open Bug Bounty and CVD Portal both deal with vulnerability disclosure, but they serve entirely different purposes. One is a community-driven reporting network, the other is a regulatory compliance tool built for the European market.

By CVDPortal Editorial Team

Security Operations2026-05-3010 min read

Preparing Internal Detection, Escalation, and Decision-Making Processes

The CRA's 24-hour clock is won or lost inside your own organisation, long before a report reaches ENISA. This is a practical guide to the detection sources, escalation paths, and decision authority that turn a vague signal at 2am into a filed early warning on time.

By The CVD Portal Team

Security Operations2026-05-299 min read

Linking Vulnerability Reporting to Broader Product and Risk Management

Article 14 reporting should be the visible output of a healthy product security programme, not a bolt-on. This closing post shows how reporting connects to vulnerability handling, SBOM, secure development, and post-market surveillance, so that filing a report is a byproduct of doing the rest well.

By The CVD Portal Team

CRA Compliance2026-05-297 min read

What NIS2 Expects of Organisations on Coordinated Vulnerability Disclosure

NIS2 splits coordinated vulnerability disclosure between a national CSIRT layer and an organisational layer. Here is what a compliant CVD policy is expected to contain, how the process should run day to day, and how it sets up the groundwork the CRA will require.

By The CVD Portal Team

CRA Compliance2026-05-209 min read

Why We Built CVD Portal and Why the September Deadline Made Us Give It Away for Free

A note from the team at Porta Regulus BV on why CVD Portal exists, why the September 2026 Article 14 tier is permanently free, and how we separated the September 2026 and December 2027 deadlines in the product model.

By Porta Regulus BV

CRA Compliance2026-05-1511 min read

Pricing the September 2026 Deadline: A PERT Cost Estimate for SME CRA Compliance

A defensible three-point PERT estimate for what it actually costs an EU SME manufacturer to meet the CRA Article 14 reporting deadline on 11 September 2026. Expected cost: ~€39,700 with a 90% interval of €33,900 to €45,500.

By The CVD Portal Team

CRA Compliance2026-05-1410 min read

CRA Incident and Vulnerability Reporting: Which Obligations Apply, When They Start, and How to Be Ready

The CRA separates vulnerability reporting from incident reporting, imposes different timelines for each, and routes notifications through ENISA and national authorities via the Single Reporting Platform. Here is what applies to your products, when it starts, and the internal processes you need before September 2026.

By The CVD Portal Team

CRA Compliance2026-05-139 min read

Security by Design Under the CRA: What It Actually Means Across the Product Lifecycle

The CRA requires security to be integrated from the earliest stages of product development, not added at the end. Risk analysis, threat modelling, static and dynamic testing, and the translation of technical findings into compliance evidence are now engineering obligations, not optional practices.

By The CVD Portal Team

CRA Compliance2026-05-128 min read

Managing CRA Compliance Across Product Portfolios: Structure, Maturity Scoring, and Audit Trails

For manufacturers with multiple products or PDE versions, CRA compliance is not a one-off project but an ongoing process. Structuring assessments by product line, using maturity scoring to track progress, and maintaining consistent, auditable evidence collection are what separate repeatable compliance from one-time checkbox exercises.

By The CVD Portal Team

Technical Deep Dive2026-05-118 min read

Is the 90-Day Disclosure Window Dead? How AI is Rewriting the Rules of CVD

LLMs have compressed vulnerability discovery and exploit development to near-zero. From simultaneous bug discovery to 30-minute patch-to-exploit pipelines, the assumptions behind traditional CVD embargoes no longer hold.

By CVDPortal Editorial Team

CRA Compliance2026-05-109 min read

CRA Technical Documentation: What Evidence Is Required and When It Must Be Produced

CRA Annex VII defines the technical documentation a manufacturer must produce and maintain. Understanding which documents are required for your product class, how they relate to risk assessments and lifecycle decisions, and when they must be created or updated is essential before the December 2027 conformity deadline.

By The CVD Portal Team

CRA Compliance2026-05-098 min read

CRA Self-Attestation: When It Is Permitted, What Evidence It Requires, and How to Build a Defensible Process

Most products with digital elements qualify for self-attestation under the CRA, but the evidence standard is not trivial. Product classification determines the route, risk assessments must be linked to essential requirements, and vulnerability handling processes must be documented before a Declaration of Conformity can be signed.

By The CVD Portal Team

CRA Compliance2026-04-1612 min read

The Four Conformity Assessment Routes Under the EU Cyber Resilience Act

A manufacturer's guide to the four CRA conformity assessment routes: from self-assessment under Module A to notified body EU Type Examination, full quality assurance under Module H, and EUCC certification for critical products. Product classification determines which route applies.

By The CVD Portal Team

CRA Compliance2026-04-168 min read

ENISA on the Future of EU Vulnerability Disclosure: What It Means for Manufacturers

ENISA's Head of Vulnerability Services on why the CVE program needs distributed governance, how the CRA Single Reporting Platform changes manufacturer obligations, and why handling vulnerability disclosure properly is now a competitive selling point.

By The CVD Portal Team

CRA Compliance2026-04-1510 min read

Five Months to September: What CRA Article 14 Compliance Actually Requires

Article 14 enforcement begins 11 September 2026 - for products already on market. Here's exactly what infrastructure manufacturers, importers, and distributors need in place before the deadline: VDP, triage authority, reporting cascade, and audit trail.

By The CVD Portal Team

CRA Compliance2026-04-159 min read

Exploitable vs. Exploited: The Legal Distinction That Defines Your CRA Compliance

The CRA draws a sharp legal line between 'exploitable' and 'actively exploited' vulnerabilities - with very different consequences for each. We break down the three-tier obligation framework, what the EUVD does and does not cover, and the 11 September 2026 reporting deadlines that reach products already on the market.

By The CVD Portal Team

CRA Compliance2025-03-2412 min read

CRA Vulnerability Handling: What Every Manufacturer Needs to Know Before September 2026

The EU Cyber Resilience Act creates the first mandatory vulnerability handling framework for products with digital elements. We break down the 26 articles, the key deadlines, and the practical steps manufacturers should take today to prepare.

By The CVD Portal Team

Technical Deep Dive2025-03-1715 min read

Anatomy of a Coordinated Vulnerability Disclosure: From Report to Patch

A step-by-step walkthrough of the full CVD lifecycle - receiving a researcher report, triaging with CVSS, coordinating with upstream maintainers, developing a fix, and publishing a CSAF advisory. Includes timeline expectations and common pitfalls.

By CVD Portal Engineering

Supply Chain Security2025-03-1010 min read

Why Your SBOM Is the Foundation of Your Security Posture

The CRA mandates Software Bills of Materials for all products with digital elements. But an SBOM isn't just a compliance checkbox - it's the foundation for vulnerability correlation, supply chain risk management, and incident response. Here's how to get it right.

By CVD Portal Engineering

CRA Compliance2025-03-038 min read

The 24-Hour Notification Obligation: Article 14 and What It Means in Practice

When a manufacturer discovers an actively exploited vulnerability, the CRA requires a 24-hour early warning to the relevant CSIRT. We examine how this obligation works, what triggers it, and how to build an internal process that meets the deadline every time.

By The CVD Portal Team

Security Operations2025-02-2414 min read

Building a Product Security Incident Response Team from Scratch

Most SMEs selling into the EU market don't have a dedicated PSIRT. With the CRA enforcement deadline approaching, here's a practical guide to establishing vulnerability handling capabilities - roles, tools, processes, and the minimum viable PSIRT.

By CVD Portal Engineering

Technical Deep Dive2025-02-1711 min read

What Is CSAF 2.0? Machine-Readable Security Advisories

CSAF 2.0 is the OASIS standard for machine-readable security advisories. We explain the format, how it maps to CRA Article 13 disclosure duties, and how CVD Portal generates CSAF advisories automatically.

By CVD Portal Engineering

CRA deadline briefing

A short email on the Cyber Resilience Act reporting obligations and the run-up to 11 September 2026.

We use your email only to send the briefing. Unsubscribe any time with one click.