The CRA reporting clock is running, but Finite State's Doc McConnell notes it doesn't start when a flaw is published. It starts when you confirm it's in your product & being exploited, a judgment call that needs knowing what's inside the build. ⏱️ #EUCRA
https://bit.ly/4hcJzNj

The EU's vulnerability reporting rule for connected products is live. Finite State's Doc McConnell says it goes well beyond US requirements:

https://bit.ly/46w5SsA

#EUCRA

September 11: the CRA gives you 24 hours to report an exploited flaw in a product you shipped. The hard part is knowing whether you owe a report at all. Manufacturers on Finite State can already tell if it is present and reachable in their build. https://bwnews.pr/4r2lQnw

#EUCRA

We built a CRA readiness assessment: seven questions you score on one shipping product. Question one: could you send a current SBOM on that product today, the actual file? First hard deadline, September 11. #EUCRA
https://finitestate.io/blog/cra-readiness-assessment

The EU CRA turns vulnerability response into an audit of facts: what shipped, when it was known, and how fast it can be proven. A false-heavy 95-vuln report shows why reporting readiness matters. #EUCRA #ENISA #OpenSource

See why Finite State customers like Quectel are ready for the EU Cyber Resilience Act. Quectel's IoT modules get scrutinized long after the sale, so it brought in Finite State early for independent testing, SBOMs, and VEX.

#EUCRA #SBOM
https://finitestate.io/resources/quectel-case-study