Cyber path in 10 steps
Thirty minutes, ten steps, in order. Each step ends with the question you should be able to answer before moving on.
1. Read what the Regulation technically requires — 5 min
Read Essential requirements, then the two pages that follow: Product security (Annex I, Part I) and Vulnerability handling (Annex I, Part II).
Be able to answer: of the thirteen Part I requirements, which do not apply to your product, and on what documented basis?
2. Know what a compliant SBOM is — 3 min
Read Definition and What the CRA requires.
Commonly used format, machine-readable, at the very least top-level dependencies — a legal floor, not a target.
Be able to answer: why do a spreadsheet and a PDF fail the requirement?
3. Pick a format and stick to it — 3 min
Read Formats, then CycloneDX and SPDX.
Be able to answer: what is your pivot format, and in which cases do you export to the other?
4. Generate — 4 min
Read Generating SBOMs and Generators.
The SBOM is produced as close to the artefact as possible, in the pipeline that builds it, never by hand afterwards.
Be able to answer: two tools produce two different SBOMs for the same artefact — how do you keep them comparable over time?
5. Wire it into CI/CD — 3 min
Read CI/CD integration.
Eight steps: build, generate, validate, sign, publish, apply policy, attach, archive.
Be able to answer: which conditions fail a build, and how does one obtain a waiver that expires?
6. Understand generate versus steer — 4 min
Read Generate and steer then Platforms.
This is the most expensive misunderstanding in the field. “You put a scanner in CI, you are compliant” is false: without centralisation you can neither answer an authority nor know which shipped versions are affected.
Be able to answer: how long does it take you to list every product containing a given component, across all shipped versions?
7. Handle vulnerabilities without drowning — 4 min
Read Vulnerability management, VEX and False positives.
A VEX is the documentary form of a reasoned decision not to fix. It is what distinguishes “handled” from “ignored”.
Be able to answer: what is your ratio of actionable to raw alerts?
8. Open a disclosure channel — 2 min
Read Disclosure policy and the public page Vulnerability disclosure.
The contact address and the published policy are substantive obligations, not courtesy pages.
Be able to answer: is your
security.txtonline, and is itsExpiresfield still in the future?
9. Arm the 24-hour procedure — 3 min
Read 24 h / 72 h / 14 d procedure and Reporting to ENISA.
An on-call rota, a tested channel, pre-filled templates, two exercises a year.
Be able to answer: what interval did you actually measure at the last exercise?
10. Monitor continuously — 2 min
Read Continuous monitoring and Supply chain risk.
A component that is clean today is vulnerable tomorrow, with no new build. An SBOM is only useful if it is replayed daily against sources that move.
Next
Secure by design, Secure updates and the technical checklist complete the path.
Four pages cover the supply chain itself, and read in this order:
- Reference incidents — fourteen dated compromises, so you know what is being discussed;
- Securing the build chain — CI as an attack surface, not merely a tool;
- Locking and updating dependencies — freeze to rebuild, update to stay clear of known vulnerabilities;
- Assessing an open source component — making Article 13(5) diligence computable.