01
Reporting
The 24-hour and 72-hour clocks, what goes in each stage, and who is allowed to send it.
CRA
CRA guides for product teams
Short answers to one CRA question each, with the date we last checked them. Start with Article 14 reporting, explained.
Start hereCRACyber Resilience Act (CRA) SBOM Software Fields: CISA 2026 vs BSI TR-03183-2Usama · checked 2 Nov 2026 · 7 min readReadWhat these guides cover
02
SBOM and supply chain
A bill of materials for each release, and the supplier evidence that has to sit with it.
03
Vulnerability handling
From a report to a written decision, a fix, and an advisory your users can read.
04
Documentation and CE
The technical file, the declaration, and what has to be true before December 2027.
05
Scope
Who is a manufacturer, which products are in, and where pure SaaS usually sits.
Which CRA duty is your team least ready for?
You'll talk to Usama, who'd build it.
30 minutes · no slides · a written answer if it's not a fit