How can a component supplier share CRA security evidence with OEM customers?
A component supplier can share supplier security evidence through the CVD Portal trust portal. Each approved OEM viewer sees the scope statement, support end date, vulnerability contact, VEX, SBOM and integrator guide for each part number.
Key takeaways
- From 11 December 2027, Article 13(5) of the Cyber Resilience Act requires a manufacturer to exercise due diligence on each component it sources from a third party, so that the component does not compromise the cybersecurity of its product.
- The Cyber Resilience Act names no document and no format for that due diligence, so each OEM sends each component supplier its own questionnaire.
- The CVD Portal trust portal gives each OEM viewer that a supplier approves one place to read and download the supplier security evidence for each product and part number.
- Every record on the trust portal is the supplier's own dated statement, which an OEM can file as evidence of its due diligence.
- The trust portal is included in Enterprise and costs €1,490 per year as an add-on to a paid Reporting or Compliance plan.
What does Article 13(5) require from an OEM?
Article 13(5) requires the manufacturer to “exercise due diligence when integrating components sourced from third parties so that those components do not compromise the cybersecurity of the product with digital elements”. The duty applies from 11 December 2027 (Article 71(2)).
The text names no document, no format and no duty for the supplier. Each OEM decides what evidence is enough, and a market surveillance authority later reads that decision in the technical documentation of the OEM. Thus each OEM customer sends its own questionnaire, and the supplier answers the same questions many times.
Two related provisions use the answers of the supplier. Article 13(6) requires the OEM to report a vulnerability that it finds in a component to the manufacturer of that component. Article 13(8) lets the OEM take into account the support periods of integrated components that provide core functions when it sets its own support period.
A component sold on its own can also be a product with digital elements, with manufacturer duties of its own. The article What CRA evidence must a component supplier give its OEM customers? maps each OEM request to the text of the Regulation and explains when a component is in scope.
What does an approved viewer see for each part?
An approved viewer sees one page for each product, with its part numbers and the records below. The supplier chooses which files each product shows.
| Record | What the viewer gets | CRA text it supports |
|---|---|---|
| CRA scope statement | What the viewer getsIn scope, outside the scope or under review, with the provision and the basis in the supplier's own words. A notice tells the viewer that the statement is the supplier's own and is not a legal opinion. | CRA text it supportsArticle 2(1), Article 3(1) and 3(5) |
| Software content statement | What the viewer getsNo software, firmware that cannot be updated in the field, firmware that can be updated, or software. For a part with no software, the SBOM row reads Not applicable. | CRA text it supportsAnnex I Part II(1) |
| Security support end date | What the viewer getsThe month and the year when security updates stop. | CRA text it supportsArticle 13(8) and 13(19) |
| Vulnerability contact and CVD policy | What the viewer getsThe security contact address and the coordinated vulnerability disclosure policy, so the OEM knows where to send an upstream report. | CRA text it supportsAnnex I Part II(5) and (6), Article 13(6) |
| CSAF advisories and VEX | What the viewer getsPublished security advisories, and a CSAF 2.0 VEX file with one product for each part number, identified by the part number and, where the supplier gives one, its CPE. | CRA text it supportsAnnex I Part II(8) |
| SBOM and HBOM | What the viewer getsCycloneDX 1.6 JSON downloads. The supplier turns on each file per product. | CRA text it supportsAnnex I Part II(1) for the SBOM, voluntary for the HBOM |
| Integrator security guide | What the viewer getsIntended purpose and security properties, foreseeable risks, secure decommissioning, and the information the integrator needs. The supplier signs off the text before viewers see it. | CRA text it supportsAnnex II points 4, 5, 8(d) and 8(f) |
| Certificates with expiry dates | What the viewer getsStandard, scope, issuer, issue date and expiry date, with the certificate file. An expired certificate stays on the page and shows Expired. | CRA text it supportsEvidence for the OEM's Article 13(5) record |
| Signed evidence pack | What the viewer getsEvery record of the product in one JSON file, and the same content as a JWS that CVD Portal signs with a published key. | CRA text it supportsEvidence for the OEM's Article 13(5) record |
The signature on the evidence pack means one thing. Porta Regulus B.V., the operator of CVD Portal, states that the supplier published this content at the time in the pack. Every conformity record also keeps the notice that it is no presumption of conformity.
Example product page
BRNV-P3 pressure sensor
- Part numbers
- BRNV-P310-LGA8 (active), BRNV-P300-LGA8 (not recommended for new designs)
- CRA scope
- In scope. Hardware component placed on the market separately (Article 3(1)). Its I2C and SPI interfaces give a direct data connection to a host device, so Article 2(1) applies.
- Software content
- Firmware that cannot be updated in the field. The program is masked into ROM.
- Security support ends
- September 2034
- Vulnerability contact
- psirt@brannvik-micro.example
- SBOM
- CycloneDX 1.6, 2 components
Who can see the evidence?
Only the viewers that the supplier approves can see the evidence. The supplier keeps a record of who opened which file and when.
- Approved viewers only
- A viewer asks for access on the supplier's portal, or the supplier sends an invitation. The viewer signs in with a single-use link. The supplier can revoke a viewer at any time, and access stops on the next page load.
- NDA before access
- The supplier can make each viewer accept its own NDA before any product page or download. A changed NDA text needs a new acceptance. The agreement is between the supplier and the viewer.
- Download log
- Each sign-in, NDA acceptance and file download goes into a log with the viewer, the product and the time. The supplier filters the log and exports it as CSV.
- Traceable packs
- Each signed evidence pack holds a viewer hash. If a pack leaks, the supplier finds the viewer who downloaded it in the download log.
What does the trust portal cost?
The trust portal is included in Enterprise. On a paid Reporting or Compliance plan, it is an add-on at €1,490 per year.
| Plan | Plan price | Trust portal |
|---|---|---|
| Reporting | €1,188 per year | Add-on, €1,490 per year |
| Compliance | €3,588 per year | Add-on, €1,490 per year |
| Enterprise | Quoted per portfolio | Included |
A supplier whose parts are outside the scope of the CRA needs no EU declaration of conformity, so Reporting with the add-on is enough. Compliance adds the conformity work for parts in scope, from the risk assessment to the EU declaration of conformity.
Prices exclude VAT. The add-on bills on the interval of your subscription. A free trial does not include the trust portal. You add it when you subscribe. Every plan is on the pricing page.
Frequently asked questions
Can a supplier share evidence for a part with no software?
Yes. The supplier records the software content statement Contains no software, and the SBOM row then reads Not applicable. For VEX, the supplier uses the CSAF labels component_not_present and inline_mitigations_already_exist, which fit a part with no code.
What does the signature on an evidence pack mean?
Porta Regulus B.V., the operator of CVD Portal, states that the supplier published this content on its trust portal at the time in the pack. The content stays the supplier's own statement, and CVD Portal does not check that it is correct. An OEM checks the signature against the public key at cvdportal.com/.well-known/did.json.
Does an OEM viewer need a CVD Portal account?
An OEM viewer needs only an email address that the supplier approves. The viewer signs in with a single-use link and pays nothing.
Can a viewer find a part by its part number?
Yes. A viewer searches the trust portal by an exact or a prefix match. For example, BRNV-P3 finds BRNV-P310-LGA8. The search shows only the parts of products that the supplier shares.
Read more
- What CRA evidence must a component supplier give its OEM customers? The seven items that OEM questionnaires ask for, mapped to the CRA text, and how VEX works for a chip with no software.
- Trust portal documentation How to share a product, import part numbers, write VEX statements, set the NDA and verify a signed evidence pack.
Sources
- Regulation (EU) 2024/2847, the Cyber Resilience Act, EUR-Lex CELEX:32024R2847. Articles 2(1), 3(1), 3(5), 13(5), 13(6), 13(8) and 71(2), Annex I Part II and Annex II.
- OASIS, Common Security Advisory Framework Version 2.0 OASIS Standard, 18 November 2022. The VEX profile and the product identification helper.
This page summarises the text of Regulation (EU) 2024/2847. It is not legal advice.
Published by Porta Regulus B.V., KvK 42062307. Read the editorial policy.
Last updated on 2026-11-02.
Give each OEM customer one place to read your evidence
Start a trial to set up your products, support periods and SBOMs. When you subscribe to Reporting or Compliance, add the trust portal and invite your OEM customers. The free classifier tells you first whether the CRA applies to a part.