Compliance Evidence Summary - Code and Prebuild

Compliance Evidence Summary - Phase 1: Code and Prebuild

Code and Prebuild activities should establish a documented foundation for cybersecurity risk management and secure software development.

Organizations should retain evidence demonstrating that product risks, security requirements, third-party dependencies, and vulnerability disclosure processes were addressed before software entered the build pipeline.

These records should be maintained and updated as appropriate throughout the product lifecycle and should support the technical documentation and vulnerability handling obligations established by the CRA.

References

• EU Cyber Resilience Act — Regulation (EU) 2024/2847
• European Commission — Cyber Resilience Act Summary
• NIST Secure Software Development Framework

Implementation Note: The CRA establishes legal obligations for covered products and economic operators. The open-source tools listed above are examples of possible engineering implementations. Their use does not independently demonstrate CRA compliance, and individual security controls should be selected according to the documented product cybersecurity risk assessment.