123% m谩s CVE notificadas al d铆a en 2026 que el a帽o pasado.

Cumplimiento del CRA para responsables de cumplimiento

Obtenga una visibilidad completa de los procesos t茅cnicos de seguridad y las pr谩cticas de desarrollo mientras afronta los requisitos del CRA con herramientas integrales de gesti贸n del cumplimiento

Documentaci贸n de cumplimiento automatizada

Genere autom谩ticamente las evidencias de la cadena de suministro que necesita la documentaci贸n t茅cnica del CRA: SBOM del build, registros de vulnerabilidades y correcciones y procedencia. Las SBOM se exportan en CycloneDX o SPDX, y la API devuelve SBOM, trazas de red y procedencia. La declaraci贸n UE de conformidad, la evaluaci贸n de riesgos y el propio expediente t茅cnico siguen siendo cosa suya, como fabricante.

Evidence from the build record SBOMs export as CycloneDX or SPDX, including the vulnerabilities found in their components, and the public REST API returns SBOMs, network traces and provenance, for customers, auditors and frameworks such as the EU Cyber Resilience Act, NIS2, FDA SBOM requirements and ISO 27001 supply chain controls. The build record SBOMs Vulnerability records Provenance Network traces Export CycloneDX SPDX REST API Who asks for it Customers Auditors Security reviews Frameworks this evidence supports EU Cyber Resilience Act NIS2 supply chain security FDA SBOM for cyber devices ISO 27001 supply chain controls

Notificaciones de vulnerabilidades del CRA

Cuando una vulnerabilidad se explota activamente, CRACI presenta las notificaciones del CRA en su nombre: la alerta temprana, la notificaci贸n y el informe final. La obligaci贸n de notificar sigue siendo suya, como fabricante.

CRA notifications, submitted for you When a vulnerability is actively exploited, the CRA sets deadlines: an early warning within 24 hours, a notification within 72 hours and a final report 14 days after a fix is available. CRACI submits them through the CRA Single Reporting Platform to the CSIRT and ENISA on the manufacturer's behalf. Actively exploited vulnerability found Aware 24 hours Early warning 72 hours Notification Fix + 14 days Final report CRACI submits on your behalf Through the CRA Single Reporting Platform to the CSIRT and ENISA and shows which products and releases are affected What stays with you The reporting obligation itself Informing affected users Severe incidents: final report within one month

Evidencias para la evaluaci贸n de la conformidad

CRACI no realiza evaluaciones de la conformidad ni emite certificaciones. Le proporciona las evidencias t茅cnicas que pide una evaluaci贸n: SBOM del build, registros de vulnerabilidades y correcciones, procedencia y trazas de red. Las SBOM se exportan en CycloneDX o SPDX y el resto llega a trav茅s de la API. Elegir la v铆a de evaluaci贸n y llevarla a cabo sigue siendo cosa suya.

Evidence for the conformity assessment CRACI supplies technical evidence: build-time SBOMs, vulnerability and remediation records, provenance and network traces, with SBOMs exported as CycloneDX or SPDX and the rest returned by the API. The manufacturer uses it in the technical documentation, runs the conformity assessment, by self-assessment or with a notified body, draws up the EU declaration of conformity and applies the CE marking. CRACI supplies the evidence Build-time SBOMs Vulnerability records Provenance Network traces The manufacturer's process Technical documentation Conformity assessment: self-assessment or notified body EU declaration of conformity CE marking CRACI does not assess, certify or manage the assessment

Marco de pol铆ticas y controles

Implante y mantenga marcos de gobernanza de ciberseguridad alineados con los requisitos del CRA. CRACI le ayuda a documentar pol铆ticas, implantar controles y hacer seguimiento de las m茅tricas de cumplimiento. Relacione sus marcos de GRC actuales con las obligaciones del CRA e identifique las carencias de cumplimiento.

CRA obligations and the evidence for them The CRA obligations that touch the software supply chain, such as the SBOM, vulnerability handling, reporting, due diligence and technical documentation, are where CRACI provides evidence. The risk assessment and the conformity assessment stay with the manufacturer. Obligation CRACI evidence Software bill of materials Yes Vulnerability handling Yes Reporting exploited vulnerabilities Submitted for you Due diligence on components Yes Technical documentation Evidence and exports Risk assessment, secure design Yours Conformity assessment, CE Yours CRACI automates a significant part of the supply chain visibility and evidence your CRA process needs

Simplifique el cumplimiento normativo

Reserve una demo para agilizar la gesti贸n del cumplimiento con CRACI

Reservar una demo