EU Cyber Resilience Act (CRA) Compliance Guide for SBOM Planning

# Assessment checklist
□ Determine if your product falls under CRA scope
□ Classify product as default, important, or critical under the CRA framework
□ Identify applicable technical requirements
□ Map current SBOM capabilities against requirements
□ Assess supply chain readiness

# Example [CI/CD](/guides/ci-cd) pipeline for CRA compliance
name: CRA Compliant SBOM Generation

on:
  push:
    branches: [main, release/*]
  release:
    types: [published]

jobs:
  cra-compliant-sbom:
    runs-on: ubuntu-latest
    steps:
    - name: Generate CRA-compliant SBOM
      run: |
        # Generate comprehensive SBOM
        syft dir:. -o cyclonedx-json=sbom.json

        # Add CRA-required metadata
        jq '.metadata.supplier = {
          "name": "Your Company Name",
          "url": "https://yourcompany.com",
          "contact": [{"email": "security@yourcompany.com"}]
        }' sbom.json > sbom-enhanced.json

        # Sign SBOM for integrity
        cosign sign-blob --key cosign.key sbom-enhanced.json > sbom.sig

    - name: Vulnerability Assessment
      run: |
        # Scan for known vulnerabilities
        grype sbom-enhanced.json -o json --file vuln-report.json

        # Check against CRA vulnerability database
        curl -X POST -H "Content-Type: application/json" \
             -d @sbom-enhanced.json \
             https://eu-cra-vulnerability-db.europa.eu/api/scan

    - name: Compliance Validation
      run: |
        # Validate against CRA requirements
        ./validate-cra-compliance.sh sbom-enhanced.json

        # Generate compliance report
        ./generate-cra-report.sh > cra-compliance-report.pdf

#!/bin/bash
# validate-cra-compliance.sh

SBOM_FILE=$1

echo "🇪🇺 EU CRA Compliance Validation"
echo "================================="

# Check required fields
echo "Checking required metadata..."
jq -e '.metadata.supplier.name' "$SBOM_FILE" > /dev/null || {
    echo "❌ Missing supplier name"
    exit 1
}

jq -e '.metadata.supplier.contact' "$SBOM_FILE" > /dev/null || {
    echo "❌ Missing supplier contact information"
    exit 1
}

# Check component coverage
COMPONENT_COUNT=$(jq '.components | length' "$SBOM_FILE")
echo "📦 Found $COMPONENT_COUNT components"

if [ "$COMPONENT_COUNT" -eq 0 ]; then
    echo "❌ No components found in SBOM"
    exit 1
fi

# Check for required component fields
echo "Validating component data..."
MISSING_VERSION=$(jq '.components[] | select(.version == null or .version == "")' "$SBOM_FILE" | jq -s length)
MISSING_PURL=$(jq '.components[] | select(.purl == null or .purl == "")' "$SBOM_FILE" | jq -s length)

if [ "$MISSING_VERSION" -gt 0 ]; then
    echo "⚠️  $MISSING_VERSION components missing version information"
fi

if [ "$MISSING_PURL" -gt 0 ]; then
    echo "⚠️  $MISSING_PURL components missing PURL identifiers"
fi

# Check for cryptographic hashes
COMPONENTS_WITH_HASHES=$(jq '.components[] | select(.hashes != null and (.hashes | length) > 0)' "$SBOM_FILE" | jq -s length)
echo "🔐 $COMPONENTS_WITH_HASHES components have cryptographic hashes"

# Validate digital signature
if [ -f "${SBOM_FILE}.sig" ]; then
    echo "✅ Digital signature found"
    cosign verify-blob --key cosign.pub --signature "${SBOM_FILE}.sig" "$SBOM_FILE" || {
        echo "❌ Invalid digital signature"
        exit 1
    }
else
    echo "⚠️  No digital signature found (consider integrity controls for higher-assurance products)"
fi

echo "✅ CRA compliance validation completed"

# cra_vulnerability_monitor.py
import json
import requests
import schedule
import time
import os
from datetime import datetime, timedelta

class CRAVulnerabilityMonitor:
    def __init__(self, sbom_path, notification_endpoint):
        self.sbom_path = sbom_path
        self.notification_endpoint = notification_endpoint
        self.last_check = datetime.now() - timedelta(days=1)

    def load_sbom(self):
        with open(self.sbom_path, 'r') as f:
            return json.load(f)

    def check_vulnerabilities(self):
        """Check for new vulnerabilities in SBOM components"""
        sbom = self.load_sbom()

        # Extract component identifiers
        components = []
        for component in sbom.get('components', []):
            if 'purl' in component:
                components.append({
                    'purl': component['purl'],
                    'name': component['name'],
                    'version': component['version']
                })

        # Query vulnerability databases
        vulnerabilities = []

        # OSV API
        osv_response = requests.post(
            'https://api.osv.dev/v1/querybatch',
            json={'queries': [{'package': {'purl': c['purl']}} for c in components]}
        )

        if osv_response.status_code == 200:
            osv_data = osv_response.json()
            for result in osv_data.get('results', []):
                vulnerabilities.extend(result.get('vulns', []))

        # NVD API
        for component in components:
            nvd_response = requests.get(
                f'https://services.nvd.nist.gov/rest/json/cves/2.0',
                params={
                    'keywordSearch': f"{component['name']} {component['version']}",
                    'pubStartDate': self.last_check.strftime('%Y-%m-%dT%H:%M:%S.000'),
                    'pubEndDate': datetime.now().strftime('%Y-%m-%dT%H:%M:%S.000')
                }
            )

            if nvd_response.status_code == 200:
                nvd_data = nvd_response.json()
                vulnerabilities.extend(nvd_data.get('vulnerabilities', []))

        # Filter and categorize vulnerabilities
        critical_vulns = []
        high_vulns = []

        for vuln in vulnerabilities:
            severity = self.get_severity(vuln)
            if severity == 'CRITICAL':
                critical_vulns.append(vuln)
            elif severity == 'HIGH':
                high_vulns.append(vuln)

        # CRA requires notification within 24 hours for critical vulnerabilities
        if critical_vulns:
            self.notify_critical_vulnerabilities(critical_vulns)

        # Update last check time
        self.last_check = datetime.now()

        return {
            'total_vulnerabilities': len(vulnerabilities),
            'critical': len(critical_vulns),
            'high': len(high_vulns),
            'timestamp': datetime.now().isoformat()
        }

    def get_severity(self, vulnerability):
        """Extract severity from vulnerability data"""
        # Implementation depends on vulnerability source format
        # This is a simplified example
        if 'severity' in vulnerability:
            return vulnerability['severity']

        # Try to extract CVSS score
        cvss_score = 0
        if 'cvss' in vulnerability:
            cvss_score = vulnerability['cvss'].get('baseScore', 0)

        if cvss_score >= 9.0:
            return 'CRITICAL'
        elif cvss_score >= 7.0:
            return 'HIGH'
        elif cvss_score >= 4.0:
            return 'MEDIUM'
        else:
            return 'LOW'

    def notify_critical_vulnerabilities(self, vulnerabilities):
        """Send notifications for critical vulnerabilities (CRA requirement)"""
        notification_data = {
            'alert_type': 'CRITICAL_VULNERABILITY',
            'timestamp': datetime.now().isoformat(),
            'vulnerabilities': vulnerabilities,
            'compliance_note': 'EU CRA requires disclosure within 24 hours',
            'sbom_path': self.sbom_path
        }

        try:
            response = requests.post(
                self.notification_endpoint,
                json=notification_data,
                headers={'Content-Type': 'application/json'}
            )
            response.raise_for_status()
            print(f"✅ Critical vulnerability notification sent: {len(vulnerabilities)} vulns")
        except Exception as e:
            print(f"❌ Failed to send vulnerability notification: {e}")

    def generate_cra_report(self):
        """Generate CRA compliance report"""
        sbom = self.load_sbom()
        vuln_status = self.check_vulnerabilities()

        report = {
            'report_type': 'EU_CRA_COMPLIANCE',
            'generated_at': datetime.now().isoformat(),
            'sbom_metadata': sbom.get('metadata', {}),
            'component_count': len(sbom.get('components', [])),
            'vulnerability_status': vuln_status,
            'compliance_status': {
                'sbom_available': True,
                'digital_signature': os.path.exists(f"{self.sbom_path}.sig"),
                'supplier_information': bool(sbom.get('metadata', {}).get('supplier')),
                'vulnerability_monitoring': True
            }
        }

        return report

def main():
    monitor = CRAVulnerabilityMonitor(
        sbom_path='sbom.json',
        notification_endpoint='https://your-security-platform.com/api/vulnerabilities'
    )

    # Schedule regular vulnerability checks
    schedule.every().hour.do(monitor.check_vulnerabilities)
    schedule.every().day.at("09:00").do(monitor.generate_cra_report)

    print("🇪🇺 EU CRA Vulnerability Monitor started")
    print("Checking vulnerabilities every hour...")

    while True:
        schedule.run_pending()
        time.sleep(60)

if __name__ == "__main__":
    main()

# Cybersecurity Risk Assessment Report
## Product: [Your Software Product]
## Version: [Product Version]
## Assessment Date: [Date]

### Executive Summary
- Overall risk level: [LOW/MEDIUM/HIGH/CRITICAL]
- Key vulnerabilities identified: [Number]
- Mitigation status: [Percentage complete]

### Risk Analysis
#### Identified Threats
1. **Supply Chain Attacks**
   - Risk Level: HIGH
   - Mitigation: SBOM implementation with digital signatures
   - Status: ✅ Implemented

2. **Vulnerable Dependencies**
   - Risk Level: MEDIUM
   - Mitigation: Continuous vulnerability monitoring
   - Status: 🟡 In Progress

### SBOM Compliance Status
- ✅ SBOM generation automated
- ✅ All components identified
- ✅ Vulnerability scanning integrated
- ✅ Digital signatures implemented
- 🟡 Public accessibility (in development)

### Remediation Plan
[Detailed plan for addressing identified risks]

# EU CRA Incident Response Plan

## Scope
This plan covers cybersecurity incidents affecting products under EU CRA regulation.

## Incident Classification
### Category 1: Critical Vulnerabilities (CVSS 9.0+)
- **Response Time**: 24 hours
- **Notification**: EU authorities, customers, public disclosure
- **Actions**: Immediate patch development, SBOM update

### Category 2: High Vulnerabilities (CVSS 7.0-8.9)
- **Response Time**: 72 hours
- **Notification**: Customers, SBOM update
- **Actions**: Patch development, risk assessment

## Response Procedures
1. **Detection** (Automated monitoring)
2. **Assessment** (Risk evaluation)
3. **Containment** (Immediate protective measures)
4. **Notification** (Stakeholder communication)
5. **Remediation** (Patch development and deployment)
6. **Recovery** (Service restoration)
7. **Lessons Learned** (Process improvement)

# supplier-requirements.yml
supplier_requirements:
  mandatory:
    - sbom_provision: true
    - vulnerability_disclosure: true
    - security_contact: true
    - incident_response_plan: true

  preferred:
    - security_certifications: ["ISO 27001", "SOC 2"]
    - penetration_testing: annual
    - secure_development: true

  contractual_terms:
    - liability_clauses: true
    - data_processing_agreements: true
    - audit_rights: true
    - termination_conditions: true

assessment_criteria:
  security_posture:
    weight: 40%
    factors:
      - vulnerability_management: 15%
      - incident_response: 10%
      - access_controls: 10%
      - data_protection: 5%

  compliance_readiness:
    weight: 30%
    factors:
      - cra_compliance: 20%
      - other_regulations: 10%

  technical_capabilities:
    weight: 30%
    factors:
      - sbom_generation: 15%
      - automated_scanning: 10%
      - update_mechanisms: 5%

EU DECLARATION OF CONFORMITY

We, [Manufacturer Name]
[Address]

declare under our sole responsibility that the product:

Product: [Software Product Name]
Model/Type: [Product Identifier]
Version: [Version Number]

to which this declaration relates is in conformity with the following Union harmonisation legislation:

- Regulation (EU) 2024/2847 (Cyber Resilience Act)

The following harmonised standards and/or technical specifications have been applied:

- [List applicable standards]

Notified body: [If applicable]
Certificate number: [If applicable]

Additional information:
- SBOM available at: [URL]
- Security contact: [Email]
- Vulnerability disclosure: [URL]

Signed for and on behalf of:
[Name and function]
[Place and date of issue]
[Signature]

# sbom_service.py - CRA-compliant SBOM service
from flask import Flask, jsonify, request, send_file
from flask_cors import CORS
import json
import os
from datetime import datetime, timedelta
import hashlib
import cryptography.hazmat.primitives.serialization as crypto_serialization
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import rsa, padding

app = Flask(__name__)
CORS(app)

class CRASBOMService:
    def __init__(self, sbom_directory, private_key_path):
        self.sbom_directory = sbom_directory
        self.private_key_path = private_key_path
        self.load_private_key()

    def load_private_key(self):
        with open(self.private_key_path, 'rb') as key_file:
            self.private_key = crypto_serialization.load_pem_private_key(
                key_file.read(),
                password=None
            )

    def get_sbom_list(self):
        """Return list of available SBOMs"""
        sboms = []
        for filename in os.listdir(self.sbom_directory):
            if filename.endswith('.json'):
                filepath = os.path.join(self.sbom_directory, filename)
                with open(filepath, 'r') as f:
                    sbom_data = json.load(f)

                sboms.append({
                    'product': sbom_data.get('metadata', {}).get('component', {}).get('name', 'Unknown'),
                    'version': sbom_data.get('metadata', {}).get('component', {}).get('version', 'Unknown'),
                    'filename': filename,
                    'last_updated': datetime.fromtimestamp(os.path.getmtime(filepath)).isoformat(),
                    'download_url': f'/api/sbom/{filename}',
                    'signature_url': f'/api/sbom/{filename}.sig'
                })

        return sboms

    def get_sbom(self, filename):
        """Get specific SBOM with metadata"""
        filepath = os.path.join(self.sbom_directory, filename)
        if not os.path.exists(filepath):
            return None

        with open(filepath, 'r') as f:
            sbom_data = json.load(f)

        # Add CRA-specific metadata
        cra_metadata = {
            'cra_compliance': {
                'version': '2024/2847',
                'last_assessed': datetime.now().isoformat(),
                'vulnerability_scan_date': datetime.now().isoformat(),
                'digital_signature': self.get_file_signature(filepath)
            }
        }

        sbom_data['metadata']['cra'] = cra_metadata

        return sbom_data

    def get_file_signature(self, filepath):
        """Generate digital signature for SBOM file"""
        with open(filepath, 'rb') as f:
            file_content = f.read()

        signature = self.private_key.sign(
            file_content,
            padding.PSS(
                mgf=padding.MGF1(hashes.SHA256()),
                salt_length=padding.PSS.MAX_LENGTH
            ),
            hashes.SHA256()
        )

        return signature.hex()

# Initialize service
sbom_service = CRASBOMService(
    sbom_directory='./sboms',
    private_key_path='./keys/private_key.pem'
)

@app.route('/.well-known/sbom')
def well_known_sbom():
    """CRA-required well-known endpoint for SBOM discovery"""
    sboms = sbom_service.get_sbom_list()

    return jsonify({
        'format': 'CycloneDX',
        'version': '1.5',
        'compliance': 'EU CRA 2024/2847',
        'sboms': sboms,
        'contact': {
            'email': 'security@yourcompany.com',
            'vulnerability_disclosure': 'https://yourcompany.com/security/disclosure'
        }
    })

@app.route('/api/sbom/<filename>')
def get_sbom(filename):
    """Get specific SBOM file"""
    sbom_data = sbom_service.get_sbom(filename)
    if not sbom_data:
        return jsonify({'error': 'SBOM not found'}), 404

    return jsonify(sbom_data)

@app.route('/api/sbom/<filename>.sig')
def get_sbom_signature(filename):
    """Get digital signature for SBOM file"""
    filepath = os.path.join(sbom_service.sbom_directory, filename)
    if not os.path.exists(filepath):
        return jsonify({'error': 'SBOM not found'}), 404

    signature = sbom_service.get_file_signature(filepath)

    return jsonify({
        'filename': filename,
        'signature': signature,
        'algorithm': 'RSA-PSS-SHA256',
        'timestamp': datetime.now().isoformat()
    })

@app.route('/api/vulnerability-status/<filename>')
def get_vulnerability_status(filename):
    """Get current vulnerability status for SBOM"""
    sbom_data = sbom_service.get_sbom(filename)
    if not sbom_data:
        return jsonify({'error': 'SBOM not found'}), 404

    # This would integrate with your vulnerability scanning system
    vulnerability_status = {
        'last_scan': datetime.now().isoformat(),
        'critical_vulnerabilities': 0,
        'high_vulnerabilities': 2,
        'medium_vulnerabilities': 5,
        'low_vulnerabilities': 12,
        'scan_tools': ['Grype', 'OSV Scanner', 'Snyk'],
        'next_scan': (datetime.now() + timedelta(hours=24)).isoformat()
    }

    return jsonify(vulnerability_status)

@app.route('/health')
def health_check():
    """Health check endpoint"""
    return jsonify({
        'status': 'healthy',
        'service': 'CRA SBOM Service',
        'compliance': 'EU CRA 2024/2847',
        'timestamp': datetime.now().isoformat()
    })

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=5000, debug=False)

# CRA [compliance checklist](/compliance/checklist)
□ Product classification completed
□ SBOM generation automated
□ Vulnerability monitoring implemented
□ Digital signatures deployed
□ Public accessibility configured
□ Incident response plan documented
□ Supplier requirements established
□ Documentation package prepared
□ CE marking process initiated
□ Staff training completed

# cra_compliance_dashboard.py
import json
import requests
from datetime import datetime, timedelta

class CRAComplianceDashboard:
    def __init__(self):
        self.compliance_checks = {
            'sbom_available': self.check_sbom_availability,
            'digital_signature': self.check_digital_signature,
            'vulnerability_monitoring': self.check_vulnerability_monitoring,
            'public_accessibility': self.check_public_accessibility,
            'documentation_complete': self.check_documentation
        }

    def run_compliance_check(self):
        results = {}
        overall_status = True

        for check_name, check_function in self.compliance_checks.items():
            try:
                result = check_function()
                results[check_name] = result
                if not result['status']:
                    overall_status = False
            except Exception as e:
                results[check_name] = {
                    'status': False,
                    'error': str(e),
                    'timestamp': datetime.now().isoformat()
                }
                overall_status = False

        return {
            'overall_compliant': overall_status,
            'last_check': datetime.now().isoformat(),
            'checks': results,
            'next_check': (datetime.now() + timedelta(hours=24)).isoformat()
        }

    def check_sbom_availability(self):
        # Check if SBOM is available and valid
        try:
            response = requests.get('https://yourapp.com/.well-known/sbom')
            return {
                'status': response.status_code == 200,
                'details': 'SBOM endpoint accessible',
                'timestamp': datetime.now().isoformat()
            }
        except Exception as e:
            return {
                'status': False,
                'details': f'SBOM endpoint error: {e}',
                'timestamp': datetime.now().isoformat()
            }

    # Additional check methods...

supplier_onboarding:
  initial_assessment:
    - security_questionnaire: required
    - sbom_capability_demo: required
    - vulnerability_process_review: required
    - compliance_documentation: required

  technical_integration:
    - sbom_format_compatibility: ["CycloneDX", "SPDX"]
    - api_integration: preferred
    - automated_notifications: required
    - digital_signatures: required

  ongoing_monitoring:
    - quarterly_reviews: required
    - vulnerability_alerts: real-time
    - compliance_audits: annual
    - performance_metrics: monthly