Continuous Vulernability Management - Phase 3: Post Deployment
Objective: Continuously identify, assess, and track newly discovered vulnerabilities affecting released software throughout the product support period.
The CRA requires manufacturers to maintain effective vulnerability handling processes and address cybersecurity risks associated with their products and integrated components. These responsibilities extend throughout the applicable product support period and include regularly reviewing product security, identifying newly disclosed vulnerabilities, and taking appropriate remediation measures.
For DevOps teams, continuous vulnerability management requires maintaining visibility into software components after release. SBOMs generated during Build and Deploy should be retained and monitored against evolving vulnerability intelligence from sources such as the National Vulnerability Database (NVD), OSV, and other security advisory databases.
When new vulnerabilities are identified, organizations should determine whether affected components are included in supported product versions, evaluate their potential exploitability and impact, and assign remediation activities to responsible teams.
Automated vulnerability correlation, risk-based prioritization, and integration with development issue tracking can help reduce the time between vulnerability disclosure and remediation.
CRA Requirements and Open-Source Tooling
| CRA Reference | Security Activity | CI/CD Implementation | Suggested Open-Source Tools |
|---|---|---|---|
| Article 13(8) | Ongoing vulnerability management | Maintain effective vulnerability handling processes throughout the applicable product support period. | OWASP Dependency-Track, Ortelius |
| Annex I, Part II(1) | Continuous component vulnerability identification | Monitor SBOM components against newly disclosed vulnerabilities and maintain product component inventories. | OWASP Dependency-Track, OSV.dev, Grype |
| Annex I, Part II(2) | Vulnerability risk assessment and prioritization | Evaluate newly discovered vulnerabilities for product relevance, exploitability, impact, and required remediation. | DefectDojo, Ortelius, OSV-Scanner |
| Annex I, Part II(3) | Continuous security testing | Conduct effective and regular security tests and reviews of supported product versions. | Trivy, OWASP ZAP, Wazuh |
| Article 13(5), Annex I, Part II(1)–(2) | Third-party component vulnerability monitoring | Identify newly disclosed vulnerabilities in integrated open-source and commercial dependencies and assess product impact. | OSV-Scanner, OWASP Dependency-Track, OpenSSF Scorecard |
| Article 13(8), Annex I, Part II(2) | Vulnerability lifecycle tracking | Track identified vulnerabilities through investigation, remediation, validation, and closure. | DefectDojo, Ortelius |
Expected Compliance Evidence
- Maintained product SBOMs and component inventories.
- Continuous vulnerability monitoring records.
- Newly identified vulnerability assessment reports.
- Product-specific vulnerability risk and exploitability determinations.
- Vulnerability remediation assignments and tracking history.
- Periodic security test and review results.
- Evidence of vulnerability handling activities throughout the product support period.