Features
CRA reporting, PSIRT and SBOM
A researcher reports a flaw in your product. From then on everyone knows where the report is, which deadline is running and what your customers will be told.
Vulnerability reports land in some mailbox, and whether the authority has to be notified is decided under time pressure.
How Complass helps
Receive reports in one place
Your own report form for your company, plus security.txt per RFC 9116 and a draft of your coordinated disclosure policy for you to check and adapt.
Triage with a clear status
Received, in triage, confirmed, fixed, disclosed: every report has its status and notes. If receipt has not been acknowledged after 5 working days, Complass reminds you.
Art. 14 CRA reporting in view
If the vulnerability is actively exploited, you create a CRA incident straight from the report: early warning, notification, final report, interim report on request and user information, each with a calculated deadline and the required content.
Do not forget your suppliers
If the vulnerability sits in an integrated component, Complass reminds you to inform the maker of that component.
Security advisory for your customers
The report turns into a security advisory in CSAF format, optionally approved by a second person, published on your advisory page and emailed to your subscribers, with proof of dispatch.
Legal and normative basis
- Art. 13 CRAArticle 13 Cyber Resilience Act Obligations of manufacturers1. When placing a product with digital elements on the market, manufacturers shall ensure that it has been designed, developed and produced in accordance with the essential cybersecurity requirements set out in Part I of Annex I. 2. For the purpose of complying with paragraph 1, manufacturers shall undertake an assessment of the cybersecurity risks associated with a product with digital elements and take the outcome …Open original (EUR-Lex – OJ L 2024/2847, 20.11.2024, corrigenda incorporated: OJ L 2024/90780, 5.12.2024; OJ L 2025/90555, 2.7.2025; OJ L 2025/90828, 17.10.2025) ↗
- Art. 14 CRAArticle 14 Cyber Resilience Act Reporting obligations of manufacturers1. A manufacturer shall notify any actively exploited vulnerability contained in the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator, in accordance with paragraph 7 of this Article, and to ENISA. The manufacturer shall notify that actively exploited vulnerability via the single reporting platform established pursuant to Article 16. 2. For the purposes of …Open original (EUR-Lex – OJ L 2024/2847, 20.11.2024, corrigenda incorporated: OJ L 2024/90780, 5.12.2024; OJ L 2025/90555, 2.7.2025; OJ L 2025/90828, 17.10.2025) ↗
- CRA Annex I Part II
- BSI TR-03183-2
- RFC 9116
Calculate CRA reporting deadlines free of charge, no sign-up
This page describes Complass features and is not legal advice.
SBOM: know what is in the product from Professional: SBOM, compare packages
SBOM per product and version
Import from CycloneDX 1.4 to 1.6 and SPDX 2.2 and 2.3, from Excel or by collection script. “Save version” creates an immutable version with a checksum.
What has changed
Compare two versions: added, removed and changed components at a glance.
Export per BSI TR-03183-2
CycloneDX 1.6, SPDX 2.3 and SPDX 3.0.1 plus VEX, checked against the mandatory fields before output.
Frequently asked questions
Does Complass submit the report to ENISA?
No. Complass calculates the deadlines and prepares the content per reporting stage. You submit the report on the reporting platform and enter the time and reference number.
What do I need for this?
Vulnerability reports, CRA incidents and security advisories are part of the CRA framework. SBOM and the CE cyber file are part of the vulnerability management building block.
Is the disclosure policy ready to use?
It is a draft built from your details. Check and adapt it before you publish it.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.