Get your firmware ready for the Cyber Resilience Act.
We're firmware engineers, not a compliance agency. We help teams shipping bare-metal and RTOS devices into the EU know exactly what's in their image, catch vulnerable components fast, and meet the 24-hour reporting clock.
The deadlines are real, and one has already passed
Regulation (EU) 2024/2847 covers every product with digital elements sold in the EU, including products from manufacturers outside the EU. Microcontroller firmware is in scope.
Actively exploited vulnerabilities and severe incidents must be reported to ENISA: early warning within 24 h, notification within 72 h, final report within 14 days.
Full obligations: secure by default, security updates for the support period, a machine-readable SBOM in the technical documentation, and CE marking.
Maximum fines for breaching the essential requirements, whichever is higher, based on worldwide annual turnover.
Most SBOM tools can't see inside your firmware
Syft, Trivy and similar tools look for package-manager lockfiles. A typical STM32 or NXP project has none: FreeRTOS, Mbed TLS, lwIP and the HAL are vendored straight into the tree. The result is an empty SBOM, or one that lists code the linker threw away.
- Reads versions from the vendored sources themselves
- Checks your linker map file, so the SBOM lists only what actually ships
- CycloneDX 1.5 with purls and CPEs, ready for Dependency-Track, OSV-Scanner and Grype
- Drop-in GitHub Action. Free and Apache-2.0
$ fwsbom . --map build/app.map --linked-only \ --name gateway --version 2.4.1 -o sbom.cdx.json COMPONENT VERSION LINKED CMSIS-Core 5.6 ? FreeRTOS-Kernel 10.6.2 yes lwIP 2.1.3 yes Mbed TLS 3.6.2 yes STM32F4xx HAL Driver 1.8.3 yes 5 component(s) · littlefs, FatFs: compiled but not linked → excluded
Services
Fixed scope, fixed price, in USD; applicable sales tax/VAT is added at checkout. Questions: chenembeddedsoftware@gmail.com
We serve commercial and industrial products only and do not accept ITAR-controlled projects.
CRA Firmware Readiness Kit
Everything a small firmware team needs to set up CRA processes in-house.
- Vulnerability-handling and coordinated-disclosure policy templates
- ENISA 24 h / 72 h / 14-day report templates
- CI pipeline: SBOM on every build, nightly CVE scan
- Step-by-step implementation guide
Firmware CRA Assessment
An engineer reviews your actual firmware and hardware configuration. See a sample report →
- Verified SBOM of the shipped image
- Known-vulnerability review of every component
- Secure boot, signing and OTA update review
- Debug port and readout-protection check
- Prioritized gap report with concrete fixes
SBOM Watch
Don't miss the 24-hour clock because nobody read the CVE feeds.
- Daily matching of your SBOM against NVD and OSV
- Alert with an impact assessment when a component is hit
- Pre-drafted ENISA early-warning notice
- Product families from $750 / month
Guides
How to generate an SBOM for an STM32CubeIDE project (EU Cyber Resilience Act)
Step by step: map file, SBOM, vulnerability scan, triage, and keeping it current in CI.
CRA Article 14: what a firmware team must do when a vulnerability is actively exploited
The 24-hour / 72-hour / final report clock, what goes in each report, and a minimum setup you can do this month.
FAQ
We're a US company. Does the CRA apply to us?
Yes, if you sell products with digital elements on the EU market. The CRA applies to manufacturers wherever they are based, and importers and distributors have obligations too.
Our product is a bare-metal microcontroller with no OS. Is it in scope?
Generally, yes. The CRA covers hardware and software products with a data connection, whether direct or indirect, and there is no exemption for firmware without an operating system. A few sectors with their own rules (for example, medical devices and motor vehicles) are excluded.
Do we need an SBOM before December 2027?
The formal SBOM requirement applies from 11 Dec 2027. But to meet the reporting deadlines already in force, you need to know within hours whether a newly exploited CVE affects your products. In practice, that takes an SBOM.
How long does an assessment take?
Assessments are not open yet; join the waitlist for early slots. Once open, they typically take about two weeks from receiving source access. The schedule is an estimate, and you pay 50% to start and 50% on delivery of the report.
Is this legal advice?
No. We provide engineering assessments and tooling. Compliance remains the manufacturer's responsibility, so consult qualified counsel for legal interpretation.