10 decisions, one incident
The CRA & SBOM quiz: could you survive a real CVE?
You are the firmware lead at Voltlark, a small EU company shipping the Nimbus K2 connected thermostat. Over ten decisions, from launch day to a live exploit, see whether your vulnerability handling would survive the EU Cyber Resilience Act.
Day 0 - launch
1 / 10
The Nimbus K2 ships across the EU today. Your compliance lead is assembling the CRA technical documentation and asks how deep the software bill of materials has to go.
What is the minimum the CRA actually requires of your SBOM?
Every answer is checked against the actual EU Cyber Resilience Act text and primary sources: SBOM requirements, CVE triage with CISA KEV and EPSS, VEX statements, and the Article 14 reporting deadlines. No trick questions, no trivia - the decisions security teams actually face.
Study guide
The facts behind the quiz
Every question is built on a verifiable statement from a primary source: the CRA text on EUR-Lex, the European Commission's reporting timeline, the CISA KEV catalog and FIRST's EPSS documentation. Here is the full list, with every source.
- What is the minimum the CRA actually requires of your SBOM?
- The CRA requires manufacturers to draw up 'a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies of the products' (Regulation (EU) 2024/2847, Annex I, Part II, point 1). It is kept in the technical documentation and provided to market surveillance authorities on request; it does not have to be public. Regulation (EU) 2024/2847, Annex I - EUR-Lex
- What makes your affected / not-affected answer reliable?
- Component identifiers such as PURL (package URL) and CPE make SBOM components machine-matchable against vulnerability databases. Reliable affected-version answers come from identifier and version matching, not from searching names in advisory text. CISA - Software Bill of Materials resources
- Which findings do you patch first?
- The CISA Known Exploited Vulnerabilities (KEV) catalog lists CVEs confirmed to be exploited in the wild. Exploitation evidence is a stronger prioritization signal than a raw severity score. CISA Known Exploited Vulnerabilities catalog
- What does that 0.94 mean?
- EPSS, maintained by FIRST, estimates the probability that a vulnerability will see exploitation activity in the wild within the next 30 days. The score is a probability; the percentile, published alongside it, is the rank among all scored CVEs. FIRST - Exploit Prediction Scoring System
- How do you make that conclusion usable by others?
- VEX (Vulnerability Exploitability eXchange) is a companion document to an SBOM stating whether a product is actually affected by a given vulnerability, with a justification, so consumers can suppress findings that do not apply. CISA - Vulnerability Exploitability eXchange
- Under CRA Article 14, when is your first report due?
- CRA Article 14 requires manufacturers to report an actively exploited vulnerability via a staged sequence anchored to awareness: early warning within 24 hours, notification within 72 hours, and a final report within 14 days. European Commission - CRA reporting obligations
- Where does the CRA reporting sequence go?
- Article 14 reports are submitted via the single reporting platform operated by ENISA, the EU Agency for Cybersecurity. European Commission - CRA reporting obligations
- When does mandatory CRA vulnerability reporting start to apply?
- The CRA (Regulation (EU) 2024/2847) entered into force on 10 December 2024. Vulnerability and incident reporting obligations apply from 11 September 2026; the essential requirements and technical documentation obligations apply from 11 December 2027. European Commission - CRA timeline
- Is a clean KEV check the whole exploited-vulnerability picture for an EU product?
- ENISA operates the European Union Vulnerability Database (EUVD), including a catalog of actively exploited vulnerabilities with EU identifiers. It complements the CISA KEV catalog, and EUVD ids are native to EU processes such as CRA Article 14 reporting. ENISA - European Union Vulnerability Database
- What does that mean for you as the manufacturer?
- An end-of-life component no longer receives upstream security fixes, while the manufacturer's CRA vulnerability-handling obligations continue for the product. Tracking component lifecycles through the SBOM turns EOL from a surprise into a roadmap item. endoflife.date - component lifecycle data
Now try it with your real SBOM
The quiz is fiction; your dependency tree is not. Upload a CycloneDX, SPDX or Syft SBOM and run the same checks the scenario is based on: inventory, quality, KEV, EPSS, EU exploited vulnerabilities and end-of-life components.