https://polkaspots.com/cra-sbom-attestation/blog/ Writing on EU Cyber Resilience Act obligations and timing, SBOM quality, CycloneDX and SPDX, and the supplier evidence problem. en-GB https://polkaspots.com/cra-sbom-attestation/blog/cra-2027-deadline-start-supplier-work-now/ https://polkaspots.com/cra-sbom-attestation/blog/cra-2027-deadline-start-supplier-work-now/ Thu, 13 Aug 2026 00:00:00 +0000 Reporting obligations begin September 2026 and are event-triggered. The expensive problem sits under the December 2027 date and continues after it. cra cyber-resilience-act cra-deadline harmonised-standards sbom annex-i https://polkaspots.com/cra-sbom-attestation/blog/publish-sbom-once-or-fill-in-five-portals/ https://polkaspots.com/cra-sbom-attestation/blog/publish-sbom-once-or-fill-in-five-portals/ Thu, 16 Jul 2026 00:00:00 +0000 Suppliers are about to be asked for SBOMs by every manufacturer they sell into, each with its own format, portal and idea of complete. That does not scale on either side. sbom suppliers cra neutral-exchange cyclonedx spdx supply-chain https://polkaspots.com/cra-sbom-attestation/blog/cra-sbom-generation-is-not-the-hard-part/ https://polkaspots.com/cra-sbom-attestation/blog/cra-sbom-generation-is-not-the-hard-part/ Thu, 18 Jun 2026 00:00:00 +0000 Binary analysis turns a firmware image into an SBOM, and does it well. It cannot make a reluctant supplier send you better data next month, and it cannot produce an attestation that the supplier stands behind. cra sbom cyber-resilience-act supplier-sbom binary-analysis supply-chain-security