Vulnerability Management Guide for CRA and Continuous Remediation
Use this guide to build a clear CRA workflow for intake, triage, remediation, disclosure, and monitoring.
First, define scope with the CRA Compliance Guide. Next, use SBOM Best Practices for accurate component data. Then compare legal overlap in CRA vs NIS2/GDPR.
When plans are ready, use Remediation to assign owners, set deadlines, and track fixes against CRA timelines.
Intake & identification
Collect signals from SBOM scans, advisories, bug bounty reports, and runtime monitoring. Standardize intake with clear metadata and product context.
Triage & prioritization
Prioritize findings by severity (CVSS), exploitability, exposure, and business impact. Create remediation plans with named owners and due dates.
Remediation & verification
Apply fixes through patches, upgrades, or mitigations. Verify each fix with testing and keep evidence for an auditable trail.
Disclosure & communication
Follow CRA timelines. Report actively exploited vulnerabilities to authorities within 24 hours, and publish advisories within 72 hours when required.
Continuous monitoring
Run periodic scans, track new CVEs for SBOM components, and maintain dashboards for SLA status and backlog health.