EU Cyber Resilience Act (CRA) Compliance Guide via Dependency-Track

Regulatory Matrix: CRA Obligations vs. Dependency-Track Capabilities

CRA Requirement	Legal Reference	Core Focus	Dependency-Track Feature
Mandatory SBOM Creation & Maintenance	Annex I Part II(1)	Keep a structured, machine-readable inventory of all software components and dependencies.	CycloneDX Ingestion API & Management: Ingests standard SBOMs, creates multi-version component trees, and tracks transitive dependencies automatically.
Vulnerability Identification & Exploitability (VEX)	Annex I Part II(1)	Identify security risks in third-party components and document whether your product is actually affected.	VEX Workflow & Analysis Engine: Automatic matching against GHSA, NVD, OSV, OSS Index, Snyk, Trivy and VulDB, combined with native VEX (Vulnerability Exploitability eXchange) triage tools.
Early Warning & Rapid Reporting	Article 14	Report actively exploited vulnerabilities to CSIRTs/ENISA within statutory deadlines (24h/72h).	Real-Time Webhooks & Alerting Rules: Triggers instant notifications via Slack, Teams, Email, Jira, Kafka, Mattermost, Webex or Webhooks upon discovering high-severity zero-days or newly disclosed CVEs.
Supply Chain Risk Management	Article 13(5)	Exercise due diligence when integrating third-party and open-source components, managing risks from unmaintained packages or non-compliant licenses.	Policy Management Engine & License Analytics: Configurable policy rules to flag copyleft/non-compliant licenses, outdated packages, and unmaintained component metrics.
Technical Documentation & Retention	Article 13(13)	Retain technical documentation and SBOM history for at least 10 years (or product lifespan).	Immutable Project Versioning & Audit Workbench: Retains historical SBOM snapshots per build tag and documents reviewer triage decisions through the built-in Audit Workbench for complete traceability.

Step-by-step Guide in Dependency-Track

Continuous SBOM Ingestion Pipeline

To comply with Annex I Part II(1), your software builds must continuously export machine-readable CycloneDX SBOMs into Dependency-Track.

1. Determine SBOM Extraction Strategy: Select the appropriate CycloneDX generator for your project stack by reviewing our SBOM retrieval memo.

2. Automate CI/CD Pipeline Ingestion: Configure your automated build pipeline (e.g., GitHub Actions, GitLab CI, Jenkins) to produce the SBOM artifact and upload it to Dependency Track SaaS as outlined in our upload guide.

3. Verify Component Tree & Provenance: Navigate to Projects > [Your Project] > Components. Verify that direct, transitive, and sub-component supplier dependencies are mapped accurately with valid Package URLs (PURI).

✕

Example of components version and license in Dependency Track SaaS

Close

VEX Workflow

Under Annex I Part II(1), discovering a CVE is not enough; you must evaluate whether your product implementation is genuinely vulnerable and generate VEX statements.

1. Automated Intelligence Matching: Dependency-Track automatically correlates your component inventory against continuously updated vulnerability intelligence feeds (NVD, GHSA, OSV, VulDB, Snyk).

2. Perform VEX Analysis: Navigate to Projects > [Your Project] > Audit vulnerabilities. Select a discovered vulnerability and record its operational impact on your product runtime:

   • State: Set to NOT_AFFECTED, AFFECTED, IN_TRIAGE, or RESOLVED.
   • Justification: When marking as NOT_AFFECTED, select a standard VEX justification (code_not_present, code_not_reachable, requires_configuration, etc.).
   • Analysis Detail: Provide a clear rationale explaining why the component execution path cannot trigger the exploit in your application.

3. Export Standard VEX Statements: Export machine-readable CycloneDX VEX documents directly from Dependency Track SaaS to accompany customer deliverables and technical audit files.

✕

Example of VEX documentation in Dependency Track SaaS

Close

Real-Time Alerts & Early Warning Notification

To fulfill mandatory Article 14 early-warning requirements (24h/72h notification windows for actively exploited vulnerabilities):

1. Set Up Notification Publishers: Navigate to Administration > Notifications > Publishers. Configure your preferred communication channels (e.g., Email, Jira, Slack, Microsoft Teams, or custom Webhooks).

2. Define CRA Policies: Navigate to Administration > Policy Management to establish compliance guardrails. We recommend prefixing policy names with CRA-. Review policy hits under Global Audit > Policy Violation Audit.

3. Define Alerting Rules: Navigate to Administration > Notifications > Alerts and create targeted alerts:

   • Notification Level: Set threshold to INFORMATIONAL or WARNING.
   • Triggers: Select POLICY_VIOLATION.
   • Publisher: Select your configured SOC or Security notification channel.
   • Filter Expression: Filter exclusively for CRA-tagged policy violations subject.policy_violation.condition.policy.name.startsWith("CRA-")

4. Connect to Incident Response: Route notification payloads directly to your Security Operations Center (SOC) or automated ticketing system (e.g., Jira) to initiate immediate triage and assess whether formal authority reporting to ENISA or your national CSIRT is required within 24 hours.

✕

Configuring notification publishers in Dependency Track SaaS

Close

✕

Defining CRA-prefixed policy rules

Close

✕

Alert rule with CEL filter expression

Close

Policy Management

To satisfy Article 13(5) supply chain risk management mandates, establish automated guardrails against prohibited licenses and unmaintained dependencies.

1. Establish License Policies: Navigate to Administration > Policy Management. Define license rules:

   • Copyleft Containment: Mark restrictive copyleft and non-commercial licenses (e.g., GPL-3.0-only, AGPL-3.0-only) as FAIL or WARN for commercial product builds.

2. Define Operational Risk Constraints:

   • Flag components flagged as end-of-life (EOL), unmaintained, or missing cryptographic hash signatures.
   • Set age thresholds to alert when dependencies fall too far behind upstream security releases.

3. Automate Pipeline Enforcement: Configure your CI/CD plugin or build steps to query policy violation metrics via the API and block builds that violate compliance parameters.

✕

Prohibiting non commercial licenses

Close

✕

Example configuration for outdated components

Close

Audit Workbench

Under Article 13(13), manufacturers must retain technical documentation, SBOM snapshots, and triage rationale for at least 10 years or the product’s expected lifespan.

1. Immutable Release Tagging: Ensure every production release creates an immutable version tag inside Dependency-Track (e.g., v1.0.0-release). Never overwrite release tags.

2. Audit Logging & Traceability: All VEX decisions, reviewer notes, status changes, and rule overrides are logged permanently in the Audit Workbench with explicit timestamps and reviewer user identities.

3. Generate Compliance Audits: Export Vulnerability Disclosure Reports (CycloneDX VDR) for external conformity assessments, market surveillance authorities, or customer security evaluations at any point during the product lifecycle.

✕

Historical versioning

Close

✕

Example of exported VDR

Close