Since 11 September 2026, actively exploited vulnerabilities must be reported within 24 hours.If it applies, how ready are we? Find your CRA gaps (6 questions, 2 min) →Find your CRA gaps
System 1 / 6
A parts list from every build
For heads of engineering, DevOps and anyone asked "are we affected?"
What it is
A list of every software part inside your product, made automatically each time you build a new version. It is called an SBOM (software bill of materials).
Why it matters
When a flaw is found in a popular part, you can answer "are we affected?" in minutes instead of weeks.
It works when
Anyone can list what is in your latest release within an hour.
What the law says
The CRA requires manufacturers to identify and document the components in their products, including a software bill of materials in a machine-readable format (Annex I, Part II (1)), and to fix vulnerabilities without delay (Annex I, Part II (2)). Generating the list automatically from every build is our recommended way of meeting that duty.
Example: ABC Heating Systems, a fictional Danish maker of connected thermostats.
Kasper Nørgaard
DevOps engineer
Sets up the build so every new version creates its parts list automatically and stores it with the release. The very first run flagged an old encryption library that no longer got security fixes.
The developers
Engineering team
Stop pulling the newest version of every part automatically. They pick exact versions and check each upgrade before it goes in.
Jonas Brandt
Head of Engineering, CRA owner
Checks the simple test: can anyone list what is in the latest release within an hour, without asking a developer?
A small team can run this system too. Here is what it takes.
Do it yourself
Add a search to the build log so "which units carry part X" answers in minutes.
Half a day of help
A developer afternoon if the log is in a format nobody can query.
Where SPS Digital Tech helps
We help you set up a parts list from every build and check it covers your third-party firmware and libraries.
The story behind it: Heartbleed, April 2014
The boss asked: "Are we affected?" The answer took three weeks.
Read the storyWe will send you the step-by-step checklist we use with clients, and answer any questions about your setup.