Engineering Blog

CVD Portal Engineering

Technical insights on coordinated vulnerability disclosure, CRA compliance, and product security engineering.

Supply Chain Security2026-09-05· 11 min read

Do you need VEX documents for CRA compliance?

The Cyber Resilience Act never uses the word VEX. It still makes exploitability the legal test, and it still requires you to share vulnerability information about third-party components. ENISA surveyed 334 organisations and found 76 percent rate supplier exploitability claims as critical or important. Here are the four statuses, the five justifications, the three competing formats, and how to choose one.

By The CVD Portal Team

CRA Compliance2026-09-04· 10 min read

Does RED DA work count toward CRA compliance?

The RED cybersecurity Delegated Regulation is repealed with effect from 11 December 2027, the day the Cyber Resilience Act applies in full. Test evidence built against EN 18031 carries forward into the CRA technical file. The vulnerability monitoring duty that starts on 11 September 2026 does not, because RED DA never asked for it. Here is what transfers, what does not, and the volume arithmetic that decides your tooling budget.

By The CVD Portal Team

CRA Compliance2026-08-30· 7 min read

Who keeps a camera secure when the installer disappears?

A Hikvision Europe security director argued in August 2026 that the customer owns the system and should never depend on one installer to keep control of it. The Cyber Resilience Act turns that design argument into a manufacturer duty that runs for at least five years.

By Porta Regulus BV

CRA Compliance2026-08-16· 7 min read

ENISA assessment report: the end of SOG-IS, the rise of EUCC, and fixed-time testing for SMEs

ENISA published its 5-year cybersecurity assessment report covering 2021 to 2025. The data confirms the retirement of SOG-IS in February 2026, the operational launch of EUCC with 24 accredited laboratories, and the standardisation of fixed-time SME testing under EN 17640 (FiTCEM). Here is what the numbers mean for manufacturers preparing for the EU Cyber Resilience Act.

By The CVD Portal Team

CRA Compliance2026-08-08· 6 min read

Germany's BSI measured security.txt adoption at 1.8 percent. We measured manufacturers and found the same hole

The BSI and the Allianz für Cyber-Sicherheit published a measurement of German website operators on 6 August 2026. Two independent scans of two different populations now point the same way, five weeks before Article 14 applies.

By Porta Regulus BV

CRA Compliance2026-08-08· 8 min read

What a CRA maturity score actually predicts

ENISA published its SME Cyber Resilience Maturity Assessment Model on 13 July 2026, and it is explicit that an advanced score is not evidence of CRA compliance. So what is the score for? Maturity measures how consistently your organisation works. Conformity measures whether one product has the evidence behind it. Why an Advanced organisation can still ship a non-conforming product, why a Level 2 team can ship a conforming one, and how to use the score for the thing it is genuinely good at, which is sequencing the work.

By The CRA Portal Team

CRA Compliance2026-08-06· 10 min read

Article 14 applies in five weeks. Run this drill before it does.

On 11 September 2026 the CRA's reporting duties become binding, and the first clock that matters runs for 24 hours from the moment you become aware. Most manufacturers can recite the deadlines and still miss them, because the gap is never knowledge, it is not knowing who files, from which account, to which CSIRT. Here is a walk-through drill that surfaces the gaps while they are still cheap.

By The CVD Portal Team

CRA Compliance2026-07-29· 11 min read

The ETSI EN 304 series: one CRA standard per Annex III product category

Everyone tracking CRA standardisation is watching the horizontal prEN 40000 series. The other half of standardisation request M/606 is 18 vertical standards, EN 304 617 to EN 304 642, one per Annex III product category, and ETSI has public drafts out for most of them. Here is the full mapping, the categories ETSI is not covering, and why none of it changes your Article 32 route yet.

By The CVD Portal Team

Supply Chain Security2026-07-29· 11 min read

The 2026 SBOM minimum elements: what changed, and where it collides with the CRA

CISA and seventeen partner agencies, seven of them EU national authorities, have replaced the 2021 NTIA SBOM minimum elements. The field count goes from seven to seventeen, Supplier Name becomes Component Producer, and Depth becomes Coverage with no minimum depth. That last change means a CRA-minimal SBOM fails the new baseline by construction. Here is the full delta, and why your SBOM can now pass one framework and fail another.

By The CVD Portal Team

CRA Compliance2026-07-27· 9 min read

Every worked example in the Commission's CRA guidance, and what changed from the draft

C(2026) 5252 carries 67 numbered examples and 5 remote data processing use cases. Fourteen of them are new since the consultation draft and one was deleted. Here is what the additions tell you about where the Commission thinks manufacturers are getting it wrong.

By The CVD Portal Team

CRA Compliance2026-07-27· 12 min read

The Commission's CRA guidance: reading the four-factor test and the support period rules

C(2026) 5252 gives manufacturers two things they have been working without. A four-factor test for whether a software update is a substantial modification, and a clear statement that five years of support is a floor rather than a default. This walks through both using the Commission's own worked examples.

By The CVD Portal Team

CRA Compliance2026-07-22· 8 min read

What an empty risk assessment leaves out

A CRA risk assessment has to be the manufacturer's own determination, which is the strongest argument for starting from an empty document. The trouble is what an empty document selects for. Teams write down the threats they already discuss and leave out the interface nobody owns, the decommissioning path, and the failure that only appears at fleet scale. What a starting draft is for, and the one property it needs to stay safe.

By The CRA Portal Team

CRA Compliance2026-07-21· 7 min read

Your CRA technical file is mostly written already

Most manufacturers approaching the CRA technical file treat it as a writing project. It is a mapping project first. Annex VII asks you to demonstrate that specific evidence satisfies specific essential requirements, and the architecture diagrams, test reports and user documentation that demonstrate them usually already exist. Here is why the mapping is the hard part, and why a gap list computed before mapping measures the wrong thing.

By The CRA Portal Team

Technical Deep Dive2026-07-20· 7 min read

Your CRA evidence already lives in Jira: importing it instead of rewriting it

Annex VII asks for records of work that engineering teams already produce, in tickets and wiki pages. Most compliance tooling asks you to transcribe that record into a second set of documents, which then starts decaying immediately. CVD Portal now reads Jira and Confluence directly, so the technical file is built from the systems where the work actually happened.

By The CVD Portal Team

CRA Compliance2026-07-17· 8 min read

Keeping CRA documentation up to date: what the Regulation actually requires

The CRA makes the technical file, the risk assessment and the EU Declaration of Conformity living documents. Article 31(2) says continuously updated, Article 13(3) says updated during the support period, and market surveillance can ask for the file a decade later. Here are the update duties, the events that trigger them, and a cadence that survives an inspection.

By The CVD Portal Team

Technical Deep Dive2026-07-17· 9 min read

Running the CRA risk assessment in practice: CVD Portal and draft prEN 40000-1-2

Article 13 requires a documented cybersecurity risk assessment, and the draft European standard prEN 40000-1-2 describes the process a manufacturer should run to produce one. This post walks through how that process works in CVD Portal's products workspace, from product context and risk acceptance criteria to the Annex I applicability table, and maps every step to the regulation and to the draft standard's clauses.

By The CVD Portal Team

CRA Compliance2026-07-16· 8 min read

What the new joint CISA CVD guidance means for CRA manufacturers

Five national cyber agencies published a joint guide on working with security researchers. It reads like a checklist for the CRA's vulnerability handling requirements. Here is the mapping, and what to do about each recommendation.

By Porta Regulus BV

CRA Compliance2026-07-16· 8 min read

Running a bug bounty programme alongside your CVD process

Bug bounties pay researchers for valid reports. The CRA does not require them, but it does require a coordinated vulnerability disclosure policy. Here is how the two approaches relate, what CVD Portal provides as the disclosure layer, and how AI triage keeps up when report volume grows.

By Porta Regulus BV

CRA Compliance2026-07-10· 8 min read

Annex II in practice: the user information the CRA makes you publish

Annex II of the Cyber Resilience Act prescribes the information and instructions every product with digital elements must ship with, from the vulnerability reporting contact to the support period end date. Here is each required item with practical examples, where the information must live, and the mistakes market surveillance will notice first.

By The CVD Portal Team

CRA Compliance2026-07-10· 8 min read

CE marking under the Cyber Resilience Act: what changes for manufacturers

From 11 December 2027 the CE mark on a product with digital elements attests cybersecurity conformity. Here are the Article 30 affixing rules, when a notified body number must accompany the mark, the sequence that must be complete before you affix it, and what market surveillance does about a wrongly marked product.

By The CVD Portal Team

Technical Deep Dive2026-07-10· 8 min read

The CRA cybersecurity risk assessment: a working methodology

Article 13 makes a documented cybersecurity risk assessment the foundation of every CRA conformity claim. Here is a working methodology, from STRIDE threat modelling per component and data flow to likelihood and impact scoring, and how the results decide which Annex I requirements apply.

By The CVD Portal Team

CRA Compliance2026-07-10· 9 min read

The complete CRA guide for SMEs: every obligation in one place

A single walkthrough of every Cyber Resilience Act obligation for a small manufacturer, from the first scope check through classification, Module A self-assessment, documentation, and CE marking to the reporting duties that begin on 11 September 2026.

By The CVD Portal Team

CRA Compliance2026-07-10· 8 min read

The CRA support period: how to determine it and where you must state it

Article 13(8) of the Cyber Resilience Act requires every product with digital elements to carry a support period that reflects how long the product will actually be used, with a five-year floor in most cases. Here is how to determine the period, where the end date must be stated, and which duties run while it lasts.

By The CVD Portal Team

CRA Compliance2026-07-10· 8 min read

Does the CRA apply to your product? A scope decision walkthrough

Article 2 decides whether the Cyber Resilience Act covers your product at all. This walkthrough works through the connectivity criterion, the sectoral exclusions, the spare parts exemption, the open-source commercial activity test, and the SaaS boundary, ending in a stepwise decision sequence.

By The CVD Portal Team

CRA Compliance2026-07-10· 8 min read

Drafting the EU declaration of conformity: a field-by-field walkthrough

The EU Declaration of Conformity is the document in which you assume legal responsibility for your product's CRA conformity. Here is every Annex V element in order, who signs it, when it must exist, how the simplified web-link version works, and how to keep it valid for the ten years the regulation demands.

By The CVD Portal Team

Technical Deep Dive2026-07-10· 9 min read

From risk assessment to technical file: how the CRA artifacts chain together

The CRA's documents are not a checklist of independent deliverables. Classification decides your route, the risk assessment decides which requirements apply, evidence rolls up into the Annex VII file, the DoC asserts what the file proves, and Annex II publishes the user-facing slice. Here is the dependency chain and how to keep it consistent.

By The CVD Portal Team

CRA Compliance2026-06-25· 9 min read

Inside the SRP reporting form: the data fields you need at 24h, 72h, and final

ENISA has published the data fields its Single Reporting Platform will collect at each stage of a CRA notification. Here is the full field map for vulnerabilities and incidents, what is mandatory when, and why the staged design rewards preparation.

By The CVD Portal Team

CRA Compliance2026-06-25· 6 min read

Voluntary reporting on the SRP: what the platform accepts beyond mandatory notifications

The Single Reporting Platform is built for mandatory CRA notifications, but it will also accept voluntary reports from anyone, covering vulnerabilities, cyber threats, incidents, and near misses. Here is who can use it, what it accepts, and when the function turns on.

By The CVD Portal Team

CRA Compliance2026-06-16· 9 min read

The clock is ticking: what Dutch executives need to know before the Cyberbeveiligingswet takes effect

The Cyberbeveiligingswet transposes NIS2 into Dutch law. Four key obligations, including executive liability and incident reporting, will change how Dutch boards manage cybersecurity.

By The CVD Portal Team

CRA Compliance2026-06-16· 8 min read

The overlapping notification clocks: CRA, NIS2 and GDPR in one view

One security event can start three legal clocks at once. The CRA, NIS2 and GDPR each demand notification on their own deadline, to their own authority, in their own format. Here is how the obligations overlap and why a manufacturer needs a single place to track them.

By The CVD Portal Team

CRA Compliance2026-06-02· 9 min read

When vulnerability and incident reporting become mandatory under the CRA

The CRA's reporting obligations do not switch on with the rest of the regulation. Article 14 applies from 11 September 2026, ahead of full conformity in December 2027, and it binds manufacturers the moment a product becomes actively exploited. Here is exactly when the duty begins and who it binds.

By The CVD Portal Team

CRA Compliance2026-06-02· 10 min read

Which vulnerabilities and incidents must be reported, and which do not

Most vulnerabilities a manufacturer handles never trigger a report to authorities. The CRA's Article 14 duty is narrow: actively exploited vulnerabilities and severe incidents affecting product security. Here is how to tell what is in scope, with worked examples and a decision framework.

By The CVD Portal Team

CRA Compliance2026-06-01· 9 min read

Understanding reporting timelines and follow-up obligations

Article 14 is a three-stage cascade: a 24-hour early warning, a 72-hour detailed notification, and a final report within 14 days or one month. Here is what each stage must contain, when the clock starts, and the follow-up duties that continue after the final report.

By The CVD Portal Team

CRA Compliance2026-06-01· 9 min read

How reporting to ENISA and national authorities is organised

When an Article 14 event occurs, reports route through a single platform to ENISA and the national coordinator CSIRT simultaneously. We explain the reporting architecture, recipients, and onward notification flows.

By The CVD Portal Team

CRA Compliance2026-05-31· 5 min read

Open Bug Bounty vs CVD Portal: what is the difference?

Open Bug Bounty and CVD Portal both deal with vulnerability disclosure, but they serve entirely different purposes. One is a community-driven reporting network, the other is a regulatory compliance tool built for the European market.

By CVDPortal Editorial Team

Security Operations2026-05-30· 10 min read

Preparing internal detection, escalation, and decision-making processes

The CRA's 24-hour clock is won or lost inside your own organisation, long before a report reaches ENISA. This is a practical guide to the detection sources, escalation paths, and decision authority that turn a vague signal at 2am into a filed early warning on time.

By The CVD Portal Team

Security Operations2026-05-29· 9 min read

Linking vulnerability reporting to broader product and risk management

Article 14 reporting should be the visible output of a healthy product security programme, not a bolt-on. This closing post shows how reporting connects to vulnerability handling, SBOM, secure development, and post-market surveillance, so that filing a report is a byproduct of doing the rest well.

By The CVD Portal Team

CRA Compliance2026-05-29· 7 min read

What NIS2 expects of organisations on coordinated vulnerability disclosure

NIS2 splits coordinated vulnerability disclosure between a national CSIRT layer and an organisational layer. Here is what a compliant CVD policy is expected to contain, how the process should run day to day, and how it sets up the groundwork the CRA will require.

By The CVD Portal Team

CRA Compliance2026-05-20· 9 min read

Why we built CVD Portal and why the September deadline made us give it away for free

A note from the team at Porta Regulus BV on why CVD Portal exists, why the September 2026 Article 14 tier is permanently free, and how we separated the September 2026 and December 2027 deadlines in the product model.

By Porta Regulus BV

CRA Compliance2026-05-15· 11 min read

Pricing the September 2026 deadline: a PERT cost estimate for SME CRA compliance

A defensible three-point PERT estimate for what it actually costs an EU SME manufacturer to meet the CRA Article 14 reporting deadline on 11 September 2026. Expected cost: ~€39,700 with a 90% interval of €33,900 to €45,500.

By The CVD Portal Team

CRA Compliance2026-05-14· 10 min read

CRA incident and vulnerability reporting: obligations, timelines, and SME readiness

The CRA separates vulnerability reporting from incident reporting. We explain the distinct statutory timelines, ENISA routing via the Single Reporting Platform, and the internal processes SMEs need.

By The CVD Portal Team

CRA Compliance2026-05-13· 9 min read

Security by design under the CRA: practical lifecycle implementation

The CRA requires security integration from early design stages. Risk analysis, threat modelling, automated testing, and technical compliance evidence are now core engineering requirements.

By The CVD Portal Team

CRA Compliance2026-05-12· 8 min read

Managing CRA compliance across product portfolios: structure, maturity scoring, and audit trails

For manufacturers with multiple products or PDE versions, CRA compliance is an ongoing operational process. Structuring assessments by product line, using maturity scoring, and maintaining auditable evidence separates repeatable compliance from one-time exercises.

By The CVD Portal Team

Technical Deep Dive2026-05-11· 8 min read

Is the 90-day disclosure window dead? How AI is rewriting the rules of CVD

LLMs have compressed vulnerability discovery and exploit development to near-zero. From simultaneous bug discovery to 30-minute patch-to-exploit pipelines, the assumptions behind traditional CVD embargoes no longer hold.

By CVDPortal Editorial Team

CRA Compliance2026-05-10· 9 min read

CRA technical documentation: required evidence and lifecycle timing

CRA Annex VII defines the technical documentation manufacturers must maintain. Understand the evidence requirements, risk assessment links, and timing rules before December 2027.

By The CVD Portal Team

CRA Compliance2026-05-09· 8 min read

CRA self-attestation: requirements, evidence standards, and methodology

Most products with digital elements qualify for CRA self-attestation. Learn the classification rules, risk assessment evidence, and vulnerability handling workflows needed to sign a Declaration of Conformity.

By The CVD Portal Team

CRA Compliance2026-04-20· 8 min read

How do machinery manufacturers implement CRA vulnerability handling under the VDMA guideline?

The VDMA CRA Vulnerability Handling Guideline gives machinery and component builders a structured process for prEN 40000-1-3 compliance and mandatory Article 14 reporting.

By Porta Regulus B.V.

CRA Compliance2026-04-16· 12 min read

The four conformity assessment routes under the EU Cyber Resilience Act

A guide to the four CRA conformity assessment routes: self-assessment under Module A, notified body EU Type Examination, Module H quality assurance, and EUCC certification for critical products.

By The CVD Portal Team

CRA Compliance2026-04-16· 8 min read

ENISA on the future of EU vulnerability disclosure: key insights for manufacturers

ENISA's Head of Vulnerability Services discusses CVE governance, the CRA Single Reporting Platform, and why professional vulnerability handling is becoming a commercial differentiator.

By The CVD Portal Team

CRA Compliance2026-04-15· 10 min read

Five months to September: what CRA Article 14 compliance actually requires

Article 14 enforcement begins 11 September 2026 for products already on the market. Here is what manufacturers, importers, and distributors need in place: VDP, triage authority, reporting cascade, and audit trails.

By The CVD Portal Team

CRA Compliance2026-04-15· 9 min read

Exploitable vs. exploited: the legal distinction that defines your CRA compliance

The CRA draws a sharp legal line between exploitable and actively exploited vulnerabilities. We explain the three-tier obligation framework, what the EUVD covers, and the September 2026 reporting deadlines.

By The CVD Portal Team

CRA Compliance2025-03-24· 12 min read

CRA vulnerability handling: what every manufacturer needs to know before September 2026

The EU Cyber Resilience Act creates the first mandatory vulnerability handling framework for products with digital elements. We break down the 26 articles, the key deadlines, and the practical steps manufacturers should take today to prepare.

By The CVD Portal Team

Technical Deep Dive2025-03-17· 15 min read

Anatomy of a coordinated vulnerability disclosure: from report to patch

A step-by-step walkthrough of the full CVD lifecycle - receiving a researcher report, triaging with CVSS, coordinating with upstream maintainers, developing a fix, and publishing a CSAF advisory. Includes timeline expectations and common pitfalls.

By CVD Portal Engineering

Supply Chain Security2025-03-10· 10 min read

Why your SBOM is the foundation of your security posture

The CRA mandates Software Bills of Materials for products with digital elements. An SBOM enables rapid vulnerability correlation, supply chain management, and incident response.

By CVD Portal Engineering

CRA Compliance2025-03-03· 8 min read

The 24-hour notification obligation: Article 14 and what it means in practice

When a manufacturer discovers an actively exploited vulnerability, the CRA requires a 24-hour early warning to the relevant CSIRT. We examine how this obligation works, what triggers it, and how to build an internal process that meets the deadline every time.

By The CVD Portal Team

Security Operations2025-02-24· 14 min read

Building a product security incident response team from scratch

Most SMEs selling into the EU market don't have a dedicated PSIRT. With the CRA enforcement deadline approaching, here's a practical guide to establishing vulnerability handling capabilities - roles, tools, processes, and the minimum viable PSIRT.

By CVD Portal Engineering

Technical Deep Dive2025-02-17· 11 min read

What is CSAF 2.0? Machine-readable security advisories

CSAF 2.0 is the OASIS standard for machine-readable security advisories. We explain the format, how it maps to CRA Article 13 disclosure duties, and how CVD Portal generates CSAF advisories automatically.

By CVD Portal Engineering

CRA deadline briefing

A short email on the Cyber Resilience Act reporting obligations and the run-up to 11 September 2026.

We use your email only to send the briefing. Unsubscribe any time with one click.