CRA · Article 14
Report an exploited vulnerability within 24 hours
Early warning within 24 hours, detailed notification within 72 hours. Impossible without knowing, every day, which versions you ship.
Compliance · Cyber Resilience Act and NIS2
CRA and NIS2: what they require for your dependencies, and what LibWatch brings you.
Report an exploited vulnerability within 24 hours, keep a machine-readable SBOM, manage your supply chain: here are the obligations, their deadlines, and the part LibWatch can take on.
Timeline
Three CRA dates to remember
Dec 10, 2024
Entry into force
Regulation (EU) 2024/2847, published in the Official Journal of the EU on November 20, 2024, enters into force.
Sep 11, 2026
Reporting within 24 hours
Since that date, any actively exploited vulnerability in a product must be reported to ENISA and the national CSIRT.
Dec 11, 2027
Full application
Essential requirements, SBOM and CE marking for products placed on the market.
What the regulations say
The obligations that affect your dependencies
CRA · Annex I, Part II
Keep a software bill of materials (SBOM)
In a commonly used, machine-readable format, covering at least the top-level dependencies, kept with the technical documentation.
NIS2 · Article 21
Manage supply chain security
The entities concerned must manage the vulnerabilities of their suppliers and of their software. Their service providers, agencies and IT service companies, feel it in their contracts.
LibWatch's part
What LibWatch provides, what remains up to you
LibWatch provides tooling for monitoring and documentation. It replaces neither your risk analysis nor your notification.
| Requirement | What LibWatch provides | What remains up to you |
|---|---|---|
| Know quickly whether an exploited vulnerability affects you | Nightly watch, the CISA KEV catalog and CERT-FR alerts on your PHP version | Assess the impact on your product |
| Machine-readable SBOM | CycloneDX 1.5 and SPDX 2.3 export, validated against the official schemas | Attach it to the technical documentation and keep it |
| Reporting to ENISA and the CSIRT | The list of affected projects and versions | The notification itself |
| End-of-life components | End-of-life dates of languages and frameworks, tracked | Plan the migrations |
This page is not legal advice
It summarizes public texts (EUR-Lex, ANSSI). To find out whether your product or your organization is concerned, get professional support.
Frequently asked questions
CRA, NIS2 and dependencies
Does my SBOM have to be public?
No. The CRA requires that you can provide it to the authorities on request; your clients may also require it by contract.
Is a web agency covered by NIS2?
Rarely directly: NIS2 targets specific sectors and company sizes, such as managed IT service providers from medium-sized companies upward. An agency mostly encounters it through its clients that are covered, who pass their security requirements on in their contracts.
Is an Excel SBOM enough?
Better to avoid it. The CRA requires a commonly used, machine-readable format: in practice, CycloneDX or SPDX, which LibWatch exports. A spreadsheet can't be processed automatically by your clients' or the authorities' tools.