244 results
CRA declaration of conformity and technical documentation, explained
What Annex V/VI's EU declaration of conformity and Annex VII's technical documentation must contain under the Cyber Resilience Act, which conformity assessment modules (Annex VIII) apply, and the 11 September 2026 / 11 June 2026 / 11 December 2027 dates that matter.
5 min read Updated
CRA harmonised standards: M/606, JTC 13 and the EN 40000 timeline
Standardisation request M/606, the European Commission mandate behind the Cyber Resilience Act's harmonised standards: which committees are drafting them, what the EN 40000 series covers, and whether any of it is Official-Journal-citable yet.
4 min read Updated
CRA obligations for importers and distributors: what changes if you don't make the product
What the Cyber Resilience Act requires from importers and distributors of products with digital elements, and when either one is treated as the manufacturer instead.
5 min read Updated
CRA obligations for open-source software stewards: the Article 24 light-touch regime
What the Cyber Resilience Act's lighter regime for open-source software stewards actually requires: the Article 24 cybersecurity policy, scoped Article 14 reporting, and how a steward differs from a manufacturer.
4 min read Updated
CRA vulnerability reporting: the 24-hour early warning, 72-hour notification and final report
How CRA Article 14 reporting works: 24-hour early warning, 72-hour notification, final report, the ENISA Single Reporting Platform and what to prepare.
5 min read Updated
Cryptographic Bill of Materials (CBOM), explained
What a CBOM inventories that a regular SBOM doesn't, how CycloneDX standardized the format with IBM Research in 2024, and how Executive Order 14412 and OMB M-26-15 (June 2026) turned it into a dated federal and contractor requirement.
6 min read Updated
CSAF 2.0 and VEX: machine-readable security advisories for device makers
What OASIS CSAF 2.0 and the VEX profile are, how CISA's minimum requirements work, and how device makers can use them to automate PSIRT advisories.
5 min read Updated
ISO/IEC 29147 and 30111: the coordinated vulnerability disclosure process explained
How ISO/IEC 29147 (disclosure) and ISO/IEC 30111 (handling) define coordinated vulnerability disclosure, and how CISA and FIRST apply the same process.
5 min read Updated
CVE Numbering Authority (CNA) rules, explained: how CVE IDs actually get assigned
How the CVE Program's CNA Operational Rules v4.1.0 actually govern CVE ID assignment — the 72-hour first-refusal clock, 24/72-hour publication deadlines, Scope Definitions, and what a CVE Record must contain — straight from the Program's own rules text.
6 min read Updated
CVSS v4.0 vs v3.1: what actually changed in vulnerability scoring
FIRST CVSS v4.0 explained: Attack Requirements, Vulnerable vs Subsequent System impact, Supplemental metrics, and the CVSS-B/BE/BT/BTE labels vs v3.1.
4 min read Updated
CWE Top 25 Most Dangerous Software Weaknesses, explained
MITRE's CISA-sponsored CWE Top 25 Most Dangerous Software Weaknesses: how the frequency × severity score is calculated, the current ranked list, and what changed in the 2025 methodology.
3 min read Updated
Cyber Resilience Act requirements: a guide for device and firmware makers
What the EU Cyber Resilience Act requires from device makers: scope, roles, CRA deadlines, Annex I, product classes, fines and first steps.
7 min read Updated
CycloneDX VEX: how the analysis state and justification fields work
CycloneDX's own VEX capability: the analysis.state, justification and response enums a device maker's SBOM tooling actually reads, standalone vs embedded VEX, and which scanners act on it.
3 min read Updated
CycloneDX vs SPDX: the two SBOM formats, compared
OWASP CycloneDX and Linux Foundation SPDX are the two SBOM data formats regulators actually name. What each covers, who maintains them, their standards-body status, and when device makers end up needing both.
4 min read Updated
DDS security: what the core spec leaves out, and what the 2021 multi-vendor disclosure found
DDS (Data Distribution Service) is the default middleware behind ROS 2 robots, medical devices and industrial control systems, but core DDS carries no mandatory security of its own. What the separate OMG DDS Security spec adds, and what a 2021 coordinated disclosure found across six independent DDS implementations.
7 min read Updated
DICOM and PACS cybersecurity: why medical imaging still runs unauthenticated by default
DICOM, the protocol behind every PACS archive and imaging workstation, assumes a trusted network and ships authentication as an optional add-on. What NEMA's PS3.15 secure-use profiles actually require, what a 2019 audit of 2,300 exposed PACS servers found, and what CISA's 2026 OFFIS DCMTK advisory shows about where imaging software is failing today.
5 min read Updated
DNP3 protocol security: what Secure Authentication covers, and what it doesn't
DNP3 runs most of North America's grid and water telecontrol — and like Modbus, its base protocol has no authentication. What IEEE 1815-2012's optional Secure Authentication layer actually adds, and what a decade of CISA advisories (IOServer, GE Proficy, Triangle MicroWorks) shows about where DNP3 stacks actually fail.
5 min read Updated
DNP3 Secure Authentication (SAv5): IEEE 1815's challenge-response layer
DNP3 Secure Authentication v5 mandates SHA-256 and AES-256 Key Wrap as its default algorithms, but a 2017 Tamarin-prover formal analysis and practitioner reporting both point to the same bottleneck: key management, not cryptography, is why SAv5 stays rare in the field.
9 min read Updated
DORA: the EU Digital Operational Resilience Act, explained
What Regulation (EU) 2022/2554 (DORA) requires of EU financial entities and their ICT providers — entry into force, scope, the main requirement areas, and the delegated technical standards filling in the detail.
4 min read Updated
EN 18031 and the RED delegated act: a guide for firmware teams
EN 18031-1, -2 and -3 under the RED Delegated Regulation 2022/30: which RED article each covers, the restrictions in the OJ, and what firmware must do.
4 min read Updated
ENISA Baseline Security Recommendations for IoT (2017), explained
ENISA's November 2017 Baseline Security Recommendations for IoT in the context of Critical Information Infrastructures: its asset taxonomy, threat taxonomy, seven high-level recommendations, and six security gaps — reproduction authorised provided the source is acknowledged.
8 min read Updated
ENISA's European Vulnerability Database (EUVD), and what NIS2 Article 12 requires
What the EU Vulnerability Database (EUVD) actually is: its NIS2 Article 12 legal basis, the critical/EU-CSIRT-coordinated/exploited categories it publishes, how it relates to CVE/NVD/CISA KEV, and ENISA's own CNA role.
4 min read Updated
ENISA Guidelines for Securing the Internet of Things (supply chain), explained
ENISA's November 2020 Guidelines for Securing the Internet of Things — the six-phase IoT supply chain reference model, its threat taxonomy, and the Actors/Processes/Technologies good-practice categories; reproduction authorised provided the source is acknowledged.
5 min read Updated
ENISA Good Practices for Security of IoT: Secure Software Development Lifecycle, explained
ENISA's November 2019 Good Practices for Security of IoT report: the six-phase secure SDLC, its asset/threat taxonomy, and the 16-domain People/Processes/Technologies good-practice catalogue; reproduction authorised provided the source is acknowledged.
6 min read Updated
Questions about this page?