20 May 2026 6 min read Security
The CRA requires a process to find, triage and fix vulnerabilities — here is a workable shape.
The loop
- Intake: monitoring, scanning and a reporting channel.
- Triage: severity, exploitability and affected versions.
- Remediation: fix, test and release an update.
- Communication: advisories and, where required, reporting.
Make it evidenceable
Track each vulnerability from intake to fix with timestamps. That record is exactly what an auditor and an authority will want to see.
Tie it to the SBOM
Your SBOM tells you which products a new CVE affects, turning a scramble into a lookup.
This is an educational explainer. For the canonical regulation reference, see the dedicated Security page — or run an assessment to see how it applies to your product.