The CRA does not only create a deadline.
It changes how long product cyber responsibility lasts.
For a manufacturer, the Cyber Resilience Act is not just a checklist to complete before going to market. It requires understanding the product, assessing its risks, handling vulnerabilities, maintaining information throughout the support period and being able to react when the context changes. VAST helps structure this continuity around the product and its versions.
The first obligations start before the main application date.
CRA reporting obligations, including those related to actively exploited vulnerabilities and severe incidents, start to apply.
The main provisions of the Cyber Resilience Act become applicable.
The starting point for CRA is also the starting point for VAST: know the product precisely.
Before handling a vulnerability, maintaining a Risk Assessment or producing technical documentation, a manufacturer needs to identify its products, versions and components. This becomes especially important when several generations or variants share the same dependencies.
In VAST, Projects and Assets structure that scope. Asset Inventory brings together Hardware and Software/SBOM composition, as well as the applications, accounts, data, interconnections, tools and update mechanisms needed to understand the product. Versioning then keeps this knowledge connected to the state that was actually released.
This foundation supports vulnerability handling, Risk Assessment, lifecycle follow-up and technical documentation with a product that is already identified and contextualized.
à intégrer
The Risk Assessment must remain understandable as the product evolves.
A useful Risk Assessment contains more than a final risk level. Teams need to be able to find the product context, feared events, reviewed scenarios, assumptions, decisions and treatments that explain the result.
VAST structures and versions the assessment around the Asset. When a version changes, a vulnerability modifies exposure or new threat information becomes relevant, teams can identify what deserves another review without losing the history of previous decisions.
The platform helps maintain the assessment over time while keeping risk decisions under the control of the responsible people.
à intégrer
The CRA requires vulnerabilities to be handled during the product lifecycle, not only detected.
Receiving a CVE is only the beginning. Teams need to know which products are affected, analyze applicability, decide on a response, follow remediation and keep the justification. Across several products and versions, this becomes difficult when each step lives in a different tool.
VAST connects the vulnerability to the product and version, centralizes investigation and VEX decisions, then follows remediation and history. Teams can return to a decision, understand the context behind it and review the situation again if the product changes.
à intégrer
When time matters, the first question is always the same: which products are actually affected?
An actively exploited vulnerability, severe incident or supply-chain issue may require a fast response. Before preparing a notification or communication, the organization needs to identify the scope: products, versions, components and potentially affected customers.
VAST cross-portfolio search helps explore that scope from a library, CVE, component or technology. Results stay connected to the product context, so investigation can start immediately instead of spending the first hours finding the right teams and files.
VAST does not replace the manufacturer's regulatory responsibility and must not be presented as automatically performing the notification. It helps gather and structure the information needed to act.
à intégrer
Reaching the market is no longer the end of the cybersecurity story.
During the support period, the product continues to receive versions, dependencies continue to evolve and new vulnerabilities continue to be published. Product cybersecurity knowledge therefore needs to remain usable after the initial release.
VAST keeps the evolution of the Asset, vulnerabilities, Risk Assessments, treatments and decisions. When the context changes, teams can identify what it affects and maintain decision continuity instead of rebuilding the product history during every incident.
à intégrer
Documentation is easier to produce when evidence has been maintained during the real work.
CRA technical documentation relies on information that already exists in product cybersecurity work: product description and version, components, Risk Assessment, vulnerability handling, implemented measures, testing and other evidence.
VAST helps structure and keep part of this information throughout the lifecycle. Reports can then be produced from a known and traceable state instead of from an urgent collection exercise spread across several teams.
The goal is not to turn VAST into a "magic compliance generator". The goal is to make the necessary information easier to find, explain and maintain.
à intégrer
VAST supports the process. It does not certify the product.
VAST helps manufacturers structure product knowledge, maintain Risk Assessments, handle vulnerabilities, follow treatments, analyze portfolio impact and produce useful views and evidence.
Product compliance still depends on architecture, technical and organizational measures, testing, documentation, applicable obligations and the relevant conformity assessment process. Those responsibilities remain with the manufacturer and, where applicable, the competent bodies.
This distinction must remain clear: VAST makes the work more manageable and traceable; it does not turn a software platform into a compliance certificate.
December 2027 is closer than it seems
Setting up SBOM, CVE monitoring, PSIRT and technical documentation takes 4 to 6 months. The right time to start is now.