Checking EU Cyber Resilience Act 24‑hour reporting trigger with cra‑watch

Описание и применение

Командам необходимо быстро определить, активна ли эксплуатация уязвимости в их продукте, чтобы соблюсти 24‑часовой срок уведомления по EU CRA. Инструмент cra‑watch автоматически проверяет зависимости, сравнивает их с OSV.dev и каталогом CISA KEV, выдавая отчёт о совпадениях и рекомендации по дальнейшим действиям.

Задача

Teams need to know if a vulnerability in their product is actively exploited to trigger the EU CRA 24‑hour early‑warning reporting clock.

Результат

Teams can reliably determine whether their product triggers the CRA 24‑hour reporting clock, reducing uncertainty and ensuring timely compliance.

Рабочий процесс

• 1. Install cra‑watch via curl and make executable.
• 2. Run ./cra-watch scan to resolve dependencies and compare against OSV.dev and KEV.
• 3. Review output: if KEV matches, decide if the vulnerability is reachable in your product and trigger the 24‑h clock.
• 4. Schedule the scan in CI (e.g., GitHub Actions) with a cron trigger to catch new KEV entries.
• 5. Document the decision and evidence in an evidence log for compliance.
• 6. If a KEV match is confirmed, file the early warning, notification, and final report per CRA timelines.

Доказательства

"If a vulnerability in a product you've placed on the EU market is being actively exploited, you owe an early warning to your coordinating national CSIRT and ENISA within 24 hours of becoming aware of it."

Источник

"It reads your lockfiles, resolves them against OSV.dev, and intersects the result with the CISA Known Exploited Vulnerabilities catalogue — the closest thing to a public register of what's genuinely being exploited in the wild."

Источник