cyber-resilience-act

Semantic SBOM/CBOM/AI-BOM diff, quality scoring, and compliance validation for CycloneDX/SPDX — component, license, and vulnerability change analysis, cryptographic inventory grading, PQC readiness (CNSA 2.0, NIST IR 8547), and regulatory gates for NTIA, FDA, EU CRA, BSI TR-03183, EUCC, SSDF, EO 14028, and the EU AI Act.

Curated resources for the EU Cyber Resilience Act (Regulation 2024/2847): regulation, harmonised standards, EUCC, SBOM, vulnerability management, conformity assessment

Open-source IoT coding agent for ESP32/ESP-IDF and Nordic nRF (NCS/Zephyr): build, flash, and debug firmware on real hardware, plus one-click EU Cyber Resilience Act (CRA) readiness with SBOM (SPDX), secure-by-design posture, and CVE remediation.

Last Mile EU CRA Compliance Tooling. Bring your own build SBOMs to generate product level SBOM and VEX based on CSAF 2.0

SBOM generator written in Go. Create EU-CRA compliant SBOMs for every ecosystem

Catch EU regulatory violations at PR time — GDPR, EU AI Act, NIS2, DORA, CRA, DSA, DMA and the Data Act. Runs entirely on your machine or CI runner, with zero data egress. Apache-2.0.

C5-DEC: Common Criteria for Cybersecurity, Cryptography, Clouds – Design, Evaluation and Certification. AI-enabled toolkit for secure system design, development and evaluation via Common Criteria, SSDLC, SpecEngine/DocEngine, CRA, SBOM, threat modelling + risk assessment, and cryptography (incl. post-quantum), CLI/TUI/GUI

Cyberismo module for EU Cyber Resilience Act

Browser-based Yocto CVE dashboard for analyzing cve-summary.json, reviewing embedded Linux vulnerabilities, and exporting HTML/PDF security reports.

Resources related to EU's Cyber Resilience Act

AI-ready knowledge base of security & compliance regulations for hardware and connected-device manufacturers - structured, indexed, and machine-readable for LLMs and agents.

Self-hosted open-source cybersecurity governance platform for ISO 27001, NIS2, DORA, CRA, product security and AI governance.

Risk-based release gate for CRA (Article 14), NIS2 and DORA compliance with SBOM, KEV correlation, and auditable evidence.

Verifiable audit substrate for AI agents — EU AI Act Article 12 ready. Apache 2.0.

Public CRA Direct documentation for SBOM evidence, Article 14 workflows, HITL review, and audit trails.

API examples for CRA Direct SBOM upload, stateless scanning, and Article 14 workflow creation.

A curated list of resources, tools and guides for the EU Cyber Resilience Act (Regulation 2024/2847)

Self-hosted threat modeling & risk assessment (TARA) for IEC 62443, EU CRA & NIS-2 - visual canvas, STRIDE, SBOM/CVE triage.

CLI for EU Cyber Resilience Act compliance evidence: SBOM validation, vulnerability checks, and signing