CVD Portal
← Hiring CRA experts

How do you hire an expert to produce an SBOM for Cyber Resilience Act compliance?

Hire a firm that delivers a machine-readable SBOM in CycloneDX or SPDX format covering at least the top-level dependencies, analyses the shipped firmware binary as well as source code, and reports known vulnerabilities per component.

Key takeaways

  1. requires a software bill of materials in a commonly used, machine-readable format covering at least the top-level dependencies.
  2. No widely recognised personal credential exists for SBOM work, so judge a provider by a sample SBOM and its method.
  3. Binary analysis finds components that a source-only SBOM misses, such as vendor SDKs and prebuilt libraries inside firmware.
  4. An SBOM is a release artefact, so the provider must produce a new SBOM for every release.

Last reviewed 17 October 2026

Published by Porta Regulus B.V. No paid placement. No provider is named or ranked.

Which CRA requirements does this service give evidence for?

  • , identify and document components (SBOM)
  • , no known exploitable vulnerabilities

Which credentials should the provider hold?

No widely recognised credential exists for SBOM work. Ask for a sample SBOM and check it against the format specifications below.

What should you ask the provider for?

  • A sample SBOM from an earlier engagement, in CycloneDX or SPDX, with the format version stated.
  • Analysis of the shipped firmware binary in addition to the package manager files.
  • A package URL (purl) or CPE and a version for each component, so vulnerability matching works.
  • A known-vulnerability report per component, with the data sources named.
  • A process to produce a new SBOM for each release.
  • A statement of which baseline the SBOM meets, the CRA minimum or a stricter list such as Germany's BSI TR-03183-2.

Which red flags should stop the hire?

  • An SBOM delivered only as a PDF or a spreadsheet.
  • Component names with no versions or identifiers.
  • A firmware SBOM built only from source code manifests.
  • A single SBOM with no plan for the next release.

Which checks apply to every CRA expert?

  • Professional liability insurance that covers the work, with the amount in writing.
  • Independence from your own developers and from any supplier whose component is in scope.
  • A fixed price for a written scope with a defined end.
  • Names and credentials of each person who does the work.
  • A deliverable you may share with a notified body and a market surveillance authority.
  • Data handling inside the EU, or a written basis for any transfer.

Sources

  1. Regulation (EU) 2024/2847 (Cyber Resilience Act), CELEX 32024R2847
  2. ECMA-424, CycloneDX bill of materials specification (2nd edition, CycloneDX 1.7)
  3. ISO/IEC 5962:2021, SPDX specification V2.2.1
  4. SPDX specifications (current community version 3.0)
  5. BSI TR-03183-2, Cyber Resilience Requirements Part 2, SBOM (version 2.1.0)

Find out which of these services your product needs

CVD Portal lists the open Annex I gaps for each product and names the kind of expert that closes each one.

Start my 14-day compliance trialStart your 14-day compliance trial

Other hiring guides

Product penetration testSecurity architecture reviewData protection reviewLegal reviewNotified bodyEUCC evaluation lab

This page is part of the EU Cyber Resilience Act guide, which explains Regulation (EU) 2024/2847 article by article.