From Compliance to Code: the Cyber Resilience Act (CRA), SBOMs, DevTeams and YOU!

The EU Cyber Resilience Act (CRA) is reshaping how manufacturers and developers must secure their products—but what does it mean for your Developer platforms, DevOps pipelines, and DevTeams? In this session, we’ll share a real-world implementation of the Technical Guideline TR-03183 from the Federal Office of Information Security. We demonstrate how to technically address CRA mandates without drowning in compliance overhead.

We’ll start by answering: "Why should Platform teams care about the CRA?" Then we’ll dive into our stack with cdxgen, DependencyTrack, and Central Cyclone to show how we automated SBOM generation, vulnerability tracking, and compliance reporting.

Transcript

3. apiVersion: v1 kind: Human metadata: name: "Bjarne Rentz" namespace: Hamburg spec: hobbies: ['bouldern','gaming','3dprint'] job: "Site Reliability Engineer" employer: "Hamburg Port Authority" certifications: - CKAD - GPM social: github: https://github.com/bjarnerentz linkedIn: linkedin.com/in/ bjarne-valentin-rentz
4. apiVersion: v1 kind: Human metadata: name: "Marcus Ross" namespace: "Hamburg" spec: hobbies: ['triathlon','movies','3dprint'] job: "CCoE Lead" employer: "Hamburg Port Authority" certifications: - Kubestronaut / Cert. Ethical Hacker - ISO-27001 cert. / ITIL-Expert - AWS-Champion / Architect social: linkedIn: linkedin.com/in/zahlenhelfer github: zahlenhelfer.github.com
18. DependencyTrack Clone and analyse each configured repo Uploads SBOMs App 1 App 2 App 3 App 4
19. DependencyTrack 1. Observes for changes 4. Uploads created SBOM into the matching Project GitOps Repo App 1 - Dev: 1.0.1 App 1 - Prod: 1.0.0 App 2 - Dev: 3.21.5 App 2 - Prod: 3.21.1 2. Identifies changed version for App 2 on Prod Application Repos App 1 App 2 3. Clones App 2 with version 3.21.1