Marcin Malinowski

Founder · · AWS consultant.

[Marcin Malinowski @mmalinowski83]

The CRA's reporting obligation applies from today. Not the whole regulation - that's December 11, 2027. Article 14 only, and it has two tracks:
- Actively exploited vulnerability → 24h early warning, 72h notification and final report 14 days after a fix exists
- Severe incident → 24h, 72h and final report one month after the 72h filing

Nothing is filed automatically. A human writes it and submits it to ENISA's platform - which means someone has to know within hours that it happened at all.

CRA Desk (https://t.co/6vgtYFoksp) watches your SBOM against OSV and CISA KEV and runs the clock.

#EUCRA #CyberResilienceAct

[Marcin Malinowski @mmalinowski83]

@CarrascosaCris_ This is where I think product security becomes an organisational problem, not just a technical one.

If you receive a warning about a vulnerable component, you need to know quickly: which products, which versions, which customers and what evidence you have about the response.

[Marcin Malinowski @mmalinowski83]

@pablomanjarress That’s true if you release often. If your release cycle is longer, the CRA makes the past matter - you may need to investigate products released months or years ago, with potentially significant regulatory consequences.

[Marcin Malinowski @mmalinowski83]

I think we're going to talk less about:

"Do you have an SBOM?"

and more about:

"Can you maintain an accurate SBOM across the entire product lifecycle?"

Generate → release → update → vulnerability → remediation → new release.

The lifecycle is the hard part.

#sbom #eucra

[Marcin Malinowski @mmalinowski83]

CRA compliance shouldn't start with a checklist.

It should start with a question:
Can we explain the security state of every product we have shipped?

If the answer is no, adding another compliance document won't fix the underlying problem.

#sbom #cra #eucra

[Marcin Malinowski @mmalinowski83]

@code_andclause Exactly. The 24h clock makes product/version traceability much more than an SBOM compliance exercise.

Knowing the vulnerable component is one thing. Knowing which shipped products are affected is the real challenge.

[Marcin Malinowski @mmalinowski83]

@texy_s This is the exact problem https://t.co/Jt7cn0cRCa is solving. Let you keep your SBOM against the product version. All starting in CI/CD

[Marcin Malinowski @mmalinowski83]

@emaann28 Did you solve the "Couldn't fetch" issue? have the same problem. On the other hand, Bing has no issues with reaching my sitemap

[Marcin Malinowski @mmalinowski83]

Hot take:

Generating an SBOM is becoming a commodity.

The harder problems are:
→ keeping it connected to product versions
→ mapping vulnerabilities to releases
→ knowing what needs remediation
→ keeping the evidence

That's where SBOM becomes Product Security.

#SBOM #EUCRA

[Marcin Malinowski @mmalinowski83]

@RubyMTemple @Scott_A_Butler Do you watch your sbom against vulnerabilities so you know that the product is affected or not?

[Marcin Malinowski @mmalinowski83]

@arjunkshah21 If you ship you software with digital elements in EU, SBOM is a must to be compliant with CRA

[Marcin Malinowski @mmalinowski83]

@RDarrylR This!

Some people may consider paying for idle time as a disadvantage, but there are options to scale to zero when you know the idle schedule

[Marcin Malinowski @mmalinowski83]

@onekey_sec And "all affected products" hides a second gap: all affected versions. One current SBOM can't tell you which releases customers still run are hit by a new CVE and you need that answer before you can inform affected users.

[Marcin Malinowski @mmalinowski83]

@IamMatteoBisi And since 11 Sept the rescan step has a legal deadline attached: a KEV hit on a version you actually shipped may be what starts Art 14's 24h early-warning clock. So the inventory has to answer "which shipped versions", not only "which images".

[Marcin Malinowski @mmalinowski83]

@SourceCodeContr @InfoWorld Most teams think "we have an SBOM" means ready. Under the CRA it usually doesn’t. The hard part is
- monitoring it against vulnerabilities
- maintaining proper process when supporting multiple version of a product
Happy to share the exact generation patterns we see working.

[Eric Johnson @edjgeek]

YES! It's out it's out, I am SO excited for this! #AWSLambda Web Functions are a game changer! A true HTTP request handler and Each execution environment handles multiple requests simultaneously (up to 128 concurrent requests per environment). Multi-region deploy, and so much more! -> https://t.co/gVCbqU39Si

[Marcin Malinowski @mmalinowski83]

@s0sta_ @linuxfoundation @OpenSearchProj I would go further. SBOM needs to be checked against vulnerabilities any time so that you know if your product is secure.

[Marcin Malinowski @mmalinowski83]

@ErSonusaini1 And don’t forget the images already shipped. When a new CVE drops, you need to know which product releases contain the affected component and not just what’s in the latest build.

[Marcin Malinowski @mmalinowski83]

@Kitware good work!

[Marcin Malinowski @mmalinowski83]

@HugoValters Agreed, continuous monitoring is the missing link. The tricky part is making sure every SBOM maps to a specific product release, especially when multiple versions are still supported. That’s where the real operational challenge starts.

[Marcin Malinowski @mmalinowski83]

@peritumAI @briskinfosec Exactly 😅 The real test is whether you can go from a CVE to the affected shipped product versions quickly. Is that mapped out at your organisation or does someone still have to investigate manually?