2026 年每日通報的 CVE 數量比前一年多 131%。

法遵人員的 CRA 法規遵循

全面掌握技術資安流程與開發實務，並以完整的法規遵循管理工具因應 CRA 要求

自動化法規遵循文件

自動產生 CRA 技術文件所需的供應鏈佐證資料：建置時 SBOM、漏洞與修補紀錄，以及來源證明（provenance）。SBOM 可匯出為 CycloneDX 或 SPDX，API 則提供 SBOM、網路追蹤紀錄與來源證明。EU 符合性聲明、風險評估與技術檔案本身，仍由身為製造商的您負責。

Evidence from the build record SBOMs export as CycloneDX or SPDX, including the vulnerabilities found in their components, and the public REST API returns SBOMs, network traces and provenance, for customers, auditors and frameworks such as the EU Cyber Resilience Act, NIS2, FDA SBOM requirements and ISO 27001 supply chain controls. The build record SBOMs Vulnerability records Provenance Network traces Export CycloneDX SPDX REST API Who asks for it Customers Auditors Security reviews Frameworks this evidence supports EU Cyber Resilience Act NIS2 supply chain security FDA SBOM for cyber devices ISO 27001 supply chain controls

CRA 漏洞通報

當漏洞遭積極利用時，CRACI 會為您準備 CRA 通報的內容供您提交：早期預警、事件通報與最終報告。通報義務仍由身為製造商的您承擔。

CRA notifications, prepared for you When a vulnerability is actively exploited, the CRA sets deadlines: an early warning within 24 hours, a notification within 72 hours and a final report 14 days after a fix is available. CRACI prepares their content; a person at the manufacturer submits them through the CRA Single Reporting Platform to the CSIRT and ENISA. Actively exploited vulnerability found Aware 24 hours Early warning 72 hours Notification Fix + 14 days Final report CRACI prepares the notification content You submit it through the Single Reporting Platform to the CSIRT and ENISA and shows which products and releases are affected What stays with you The reporting obligation itself Informing affected users Severe incidents: final report within one month

符合性評鑑所需的佐證資料

CRACI 不執行符合性評鑑，也不核發認證。它提供評鑑所要求的技術佐證資料：建置時 SBOM、漏洞與修補紀錄、來源證明與網路追蹤紀錄。SBOM 可匯出為 CycloneDX 或 SPDX，其餘資料則透過 API 取得。評鑑途徑的選擇與執行仍由您負責。

Evidence for the conformity assessment CRACI supplies technical evidence: build-time SBOMs, vulnerability and remediation records, provenance and network traces, with SBOMs exported as CycloneDX or SPDX and the rest returned by the API. The manufacturer uses it in the technical documentation, runs the conformity assessment, by self-assessment or with a notified body, draws up the EU declaration of conformity and applies the CE marking. CRACI supplies the evidence Build-time SBOMs Vulnerability records Provenance Network traces The manufacturer's process Technical documentation Conformity assessment: self-assessment or notified body EU declaration of conformity CE marking CRACI does not assess, certify or manage the assessment

政策與控制措施框架

導入並維護符合 CRA 要求的資安治理框架。CRACI 協助您將政策文件化、實施控制措施，並追蹤法規遵循指標。將您現有的 GRC 框架對應至 CRA 義務，找出法規遵循上的缺口。

CRA obligations and the evidence for them The CRA obligations that touch the software supply chain, such as the SBOM, vulnerability handling, reporting, due diligence and technical documentation, are where CRACI provides evidence. The risk assessment and the conformity assessment stay with the manufacturer. Obligation CRACI evidence Software bill of materials Yes Vulnerability handling Yes Reporting exploited vulnerabilities Prepared for you Due diligence on components Yes Technical documentation Evidence and exports Risk assessment, secure design Yours Conformity assessment, CE Yours CRACI automates a significant part of the supply chain visibility and evidence your CRA process needs

簡化法規遵循工作

預約示範，了解如何以 CRACI 簡化法規遵循管理

預約示範