Build and Deploy Tasks

Achieving Build and Deploy Tasks of the The Cyber Reslience Act

The European Union Cyber Resilience Act (CRA) establishes cybersecurity requirements for products with digital elements throughout their lifecycle. During Build and Deploy, organizations should validate product security, generate and maintain Software Bills of Materials (SBOMs), protect software artifact integrity, and collect the technical evidence necessary to demonstrate compliance.

This phase focuses on ensuring that software releases satisfy applicable cybersecurity requirements before they are distributed or placed on the market. By integrating security testing, vulnerability scanning, SBOM generation, artifact verification, and evidence collection into CI/CD workflows, organizations can identify security weaknesses, prevent the release of insecure artifacts, and establish traceability between source code, builds, releases, and deployed products.

The following activities map CRA requirements to actionable CI/CD practices and suggested open-source tools. The tools are illustrative and are not mandated by the regulation.