Your SBOM desk for the CRA
Cyber Resilience Act readiness for small software vendors
If a vulnerability in your dependencies turns out to be actively exploited, you have 24 hours to file an early warning with ENISA - for products you shipped years ago too. CRA Desk is your SBOM desk for the CRA.
AWS Ireland hosting, EU invoicing, DPA on request.
24 hours to report an actively exploited vulnerability - from 11 September 2026
24 hours
Early warning to the CSIRT coordinator and ENISA, from the moment you become aware.
72 hours
Vulnerability notification with what you know and what you are doing about it.
14 days
Final report, counted from a corrective or mitigating measure being available.
Start in CI, for free
Point the CRA Desk scan at the SBOM your build already produces - GitHub Action or GitLab CI/CD component. It reports what your inventory does and does not tell you and what the reporting obligation needs from you, right in your pipeline output, no account required.
- uses: actions/checkout@v4
- run: npx @cyclonedx/cdxgen -o sbom.json .
- uses: mmalinowski/cradesk-action@v1
with:
sbom-path: sbom.jsonOnly the first step changes with your stack - the CRA Desk step after it is identical everywhere.
Setup blocks, output paths and traps per ecosystemHow the product works
Watching for vulnerabilities is table stakes - filing the report before the clock runs out is the job.
- 1
Classify the product - scope, class and the conformity route that follows, with the article behind each answer.
- 2
Ingest the SBOM from CI, keep it per product version and diff it as it changes.
- 3
- Watch OSV advisories against your components across nine package ecosystems.
- CISA KEV supplies the "actively exploited" flag - a flag, not a guess.
- Dismissing a false match saves the reason in the standard VEX format, not just a checkbox.
- 4
Run the reporting workflow: deadline timers, drafts per stage and a human who files them.
Your SBOM stays in our environment - never shared, never sold.
Your CI/CD
- Your pipeline generates the SBOM
- Uploaded to CRA Desk
- Stays in our environment
CRA Desk's watch (background)
- OSV, NVD and CISA KEV feeds
- Refreshed on a schedule
- Matched against your components
Plans
Free
0 EUR
- 1 product
- SBOM in the panel
- CVD policy and security.txt generators
- No monitoring
Starter
29 EUR/mo
- 2 products
- OSV/KEV watch with alerts across nine ecosystems
- Article 14 reporting workflow with deadline timers
Team
99 EUR/mo
- 5 products
- Multiple users
- Annex VII technical-documentation skeleton
- SBOM diff
- Custom document templates
Enterprise
Custom
- More products and seats
- Custom CI or reporting integrations
- Invoicing on contract terms
Team's five seats cost less than a single day of contractor time spent maintaining your own OSS scanning stack - and still land well under a typical Mend or Snyk contract, which starts around 20,000 EUR a year.
Prices are net, excluding VAT.
Hosted in AWS Ireland (eu-west-1). DPA on request and an EU invoice carrying your VAT ID on every paid plan.
What this does not do
Nothing is ever submitted to ENISA or a CSIRT on your behalf: the product computes deadlines, drafts reports and nags - a human reviews and files. Vulnerability coverage is declared (NVD, OSV, CISA KEV), never claimed to be complete.
We tell you exactly what's covered and what isn't. Matching runs on OSV advisories for nine language ecosystems - system packages (Debian, Ubuntu, Alpine), container images and components with no purl aren't matched at all and NVD only adds a CVSS score once a match already exists, never finds one.
We hold ourselves to the same rule: our own security.txt and CVD policy are generated by this product.
Read themGet the full report by e-mail
One e-mail when the classifier and the reporting workflow open up. No newsletter.
Write to us