Onboarding Guide: CRA Setup, First Assessment, SBOM Import

Welcome! This guide walks you through the quickest path to value: account creation, workspace setup, your first CRA assessment, SBOM import, and turning findings into action.

For regulation scope and obligations, use the CRA Compliance Guide. Harden your build inputs with SBOM Best Practices and close the loop with the Vulnerability Management Guide. Browse more materials in the Resources hub.

Overview

The platform helps you operationalize EU Cyber Resilience Act readiness. You'll centralize assessments, automate evidence, connect software bill of materials (SBOM) data, and manage remediation with deadlines and ownership.

Five‑minute quickstart

Create your account and verify your email
Name your organization and choose a plan (start Free)
Create a new CRA assessment and provide basic details
Link at least one asset to the assessment
Import an SBOM (CycloneDX or SPDX) to the assessment
Answer the guided questionnaire, optionally referencing SBOM data
Review vulnerabilities and create an initial remediation plan

Create your account

Go to /register. Enter your name, work email, and a strong password. If you were invited, the invite link pre‑fills your organization.

If you create a new workspace, you become its administrator. If you join via invite, your role is assigned by the inviter. You can manage users later under Admin → Settings → Users.

Verify your email

Check your inbox for a verification email. Click the link to activate your account. This protects access and enables secure notifications.

Set up your workspace

After login, you’ll usually land on the dashboard. Open Admin → Organizations to review your organization profile and legal contacts. Configure timezone and language under Admin → Settings → Generic.

Confirm organization name and contact email
Set timezone and language in Generic settings
Review role‑based access in User Management

Invite your team

Go to Admin → Settings → Users to add users and manage roles. Depending on plan and seat availability, invite-by-email flows are also available in organization management.

Recommended roles

Admin – Full organizational access, including user management and billing.
User – Manage assessments, assets, and remediation plans.
Viewer – Read‑only access to dashboards and reports.

Run your first assessment

Open Assessments and create a new CRA assessment. Complete required product details in the product step (name, version, intended use, support period), then continue to SBOM upload.

Create an assessment and define scope (product/system)
Provide required product metadata (name, version, intended use, support period)
Proceed to SBOM import step to unlock the questionnaire

Import your SBOM

Once you've created an assessment and linked at least one asset, upload an SBOM to unlock the questionnaire. Open your assessment and navigate to the SBOM upload section. The platform parses components and links detected vulnerabilities after scanning. After upload, the guided questions become available for you to answer and optionally reference SBOM data when relevant, then attach evidence.

Export SBOM from your build pipeline or security tool
Ensure at least one asset is linked to the assessment
Open your assessment and navigate to the SBOM upload section
Upload the file (XML or JSON in CycloneDX or SPDX format)
Answer the guided controls, optionally referencing SBOM data
Attach evidence (documents, screenshots, logs) directly to answers
Confirm component count & ecosystem

If you upload updated SBOMs for the same assessment over time, use clear file names and product versions to keep tracking tidy.

Triage vulnerabilities & plan remediation

Go to Remediation to create plans from detected vulnerabilities. Assign owners, set due dates, and track progress. Use severity and business impact to prioritize high‑impact fixes.

Practical triage

Start with Critical and High severity, especially on internet‑facing components. Batch related issues into a single plan if they share the same fix (e.g., dependency upgrades).

Notifications & reminders

Configure preferences under Account → Notifications. You can control whether notification emails are sent and how frequently they are delivered.

Data retention & evidence

Evidence retention helps demonstrate compliance while meeting privacy obligations. Retention settings are available to god-role users under Admin → Settings → Retention.

Policy note

Keep only what you need for as long as you need it. Align evidence retention with internal policies and regulatory requirements.

Plans & billing

Start on the Free plan and upgrade when your scope grows. Review usage and change plans anytime under Billing.

Free: evaluation with limited scope
Pro: small teams validating readiness
Enterprise: scale across products and teams

Troubleshooting

Can’t sign in? Use Forgot password and check for the email in spam/junk.
SBOM upload errors? Ensure valid CycloneDX/SPDX format and keep files within the 5 MB upload limit.
Missing data? Reload the dashboard; background jobs may still be processing.
Permission issues? Ask an Admin to confirm your role in Admin → Settings → Users.