Product Security Operations: SBOM, PSIRT and Vulnerability Handling
Running product security as operations: knowing what's in each release, fixing what's found, and reporting what's exploited.
Product security is the work of keeping the products you ship secure after they leave the factory: knowing what’s inside them, finding and fixing their vulnerabilities, telling customers, and reporting to authorities when the law requires it. Under the EU Cyber Resilience Act, much of this is now mandatory for products sold in the EU [1]. This hub treats it as operations and engineering, not paperwork.
Who this is for
- Engineering and product leaders who now own vulnerability handling for products sold in the EU.
- Firmware leads asked for an SBOM by a customer, an auditor or their own security team.
- Whoever will be on call when an actively exploited vulnerability is reported, because the 24-hour clock already applies [1].
Product security vs application security
- Application security usually means securing software your organization builds and runs, such as web apps and services.
- Product security covers what you sell: the device, its firmware, its companion apps and the cloud back-end it depends on, across its whole support period. Under the CRA, a product’s remote data processing solutions are part of the product [1]. FIRST, the global incident-response forum, describes a product security incident response team (PSIRT) as the function inside an organization that identifies, assesses and deals with the risks from vulnerabilities in the products it makes or sells [3].
In practice, product security work for connected products draws on firmware, hardware and supplier knowledge, and its processes have to last as long as the support period.
What the Cyber Resilience Act makes mandatory
| Operation | What the Cyber Resilience Act requires (paraphrased) | Applies from | Guide |
|---|---|---|---|
| Know your components | Identify and document vulnerabilities and components, including an SBOM in a commonly used, machine-readable format covering at least top-level dependencies [1] | 11 Dec 2027 [1] | SBOM generation for embedded products |
| Fix without delay | Address and remediate vulnerabilities without delay, including through security updates [1] | 11 Dec 2027 [1] | PSIRT guide |
| Disclosure policy | Put in place and enforce a coordinated vulnerability disclosure policy, and provide a contact address for reports [1] | 11 Dec 2027 [1] | Coordinated vulnerability disclosure |
| Report exploited vulnerabilities and severe incidents | Notify simultaneously the CSIRT designated as coordinator and ENISA, via the single reporting platform: 24h early warning, 72h notification, final report [1] | 11 Sep 2026, including products already on the market [1] | Cyber Resilience Act reporting obligations now apply; Cyber Resilience Act reporting workflow |
| Support period | Handle vulnerabilities for the support period, at least five years unless the product is expected to be in use for less [1] | 11 Dec 2027 [1] | PSIRT guide |
Start here
- Reporting first. It already applies [1]. Make sure someone owns the "actively exploited?" decision and has access to the single reporting platform. See how to set up a PSIRT.
- SBOM per release. CISA describes an SBOM as a nested inventory, a list of the ingredients that make up software components [2]. See SBOM generation for embedded products.
- Connect the two. Use SBOMs to triage new vulnerabilities across your fleet. A VEX document, a form of security advisory, tells customers whether a product is affected by a known vulnerability [2].
- Publish a disclosure policy and a reporting contact.
Guides in this section
- How to set up a PSIRT for connected products: charter, roles, intake, triage, fixes, advisories and the CRA reporting clock.
- SBOM generation for embedded products: binary blobs and vendor BSPs, build vs binary analysis, SPDX or CycloneDX, per-release SBOMs.
Sources
All accessed 2026-11-10.
- Regulation (EU) 2024/2847 (Cyber Resilience Act), OJ L, 2024/2847, 20.11.2024. Cited: Art. 3(1)–(2), 13(8), 13(17), 14, 16, 69(3), 71(2); Annex I Part II points (1), (2), (5), (6). EUR-Lex, ELI: http://data.europa.eu/eli/reg/2024/2847/oj
- CISA, "Software Bill of Materials (SBOM)" (SBOM and VEX descriptions). https://www.cisa.gov/sbom
- FIRST, "PSIRT Services Framework 1.1" (Introduction). https://www.first.org/standards/frameworks/psirts/psirt_services_framework_v1.1
Spotted an error? Report it to our corrections log. Read our editorial methodology.