March Office Hours: Building Your CRA Vulnerability Management Plan

Cyber Resilience Act (CRA) Explained: Vulnerability Management & SBOM Compliance with DefectDojo Greg Anderson, CEO and creator of DefectDojo, hosts a webinar explaining the EU Cyber Resilience Act (CRA), focusing on what the regulations say, who is subject to them (including non-EU companies doing business in Europe), key dates, and GDPR-like penalties. He highlights CRA requirements around vulnerability management, SBOM maintenance and export formats (CycloneDX and a Linux Foundation standard), and a three-step reporting workflow: notify authorities within 24 hours of discovery, assess exploitability/impact within 72 hours, and complete follow-up reporting with remediation expectations tied to a 14-day timeline. Anderson outlines how DefectDojo supports CRA-aligned Vulnerability Management through data import, triage, deduplication, threat-intel enrichment, risk dashboards, SLA-based remediation, and verification, and describes planned enhancements including a new “locations” framework for complete SBOM tracking and future reporting workflow management. He also previews a new PSIRT engine that turns multiple threat feeds into actionable findings. 00:00 Welcome and Agenda 01:01 What Is the CRA 01:45 Scope Fines and Classification 03:59 Key Dates and Core Duties 04:53 SBOM and Reporting Workflow 06:33 DefectDojo CRA Readiness 06:59 Locations Framework for SBOMs 08:32 Reporting Feature and End to End Flow 10:03 Getting Data In and Triage 11:22 Deduplication and Enrichment 14:16 Remediation SLAs and Verification 15:19 Practical Next Steps to Comply 17:28 New PSIRT Engine Preview 20:14 Q&A and Closing