Partners · SquareVertex × Black Duck

Software supply chain security, ready for the CRA and NIS2

Most of the code you ship, you didn't write. With Black Duck we find every open-source and third-party component in your software, keep SBOMs current, fix what is vulnerable — and give you the evidence the EU Cyber Resilience Act and NIS2 expect.

Book a Start Here call What the CRA requires

SBOM in SPDX & CycloneDX CRA & NIS2 evidence Open source, licences & binaries

Why now

The Cyber Resilience Act makes software supply chains a legal duty

Anyone placing products with digital elements on the EU market — software, firmware, connected devices — must know what is inside them and keep it secure for the support period. NIS2 Article 21 adds supply-chain security for essential and important entities and their suppliers.

Know what's in your product

Draw up an SBOM covering at least the top-level dependencies, as part of the technical documentation.

Handle vulnerabilities for the support period

Identify, document and remediate vulnerabilities without delay, with security updates for users.

Report what's actively exploited

Notify actively exploited vulnerabilities and severe incidents — reporting obligations apply from 11 September 2026.

Be ready by December 2027

The CRA's main obligations apply from 11 December 2027, with fines of up to €15M or 2.5% of global turnover.

Regulation (EU) 2024/2847 (Cyber Resilience Act) and Directive (EU) 2022/2555 (NIS2). This is a summary, not legal advice.

See every component, fix what matters

Software composition analysis

Identifies open-source and third-party components — including copied snippets — with their known vulnerabilities and licences.

SBOMs you can hand over

Generate and import software bills of materials in SPDX and CycloneDX, and keep them current as code changes.

Vulnerability intelligence

Matches components against curated vulnerability data, so teams see what affects them and how to fix it.

Licence compliance

Flags licence conflicts and obligations before they reach a customer or an acquirer.

Static analysis

Coverity finds weaknesses in your own code, alongside the open-source view.

Binary analysis

Inspects compiled software and firmware from suppliers when you have no source code.

Product capabilities as described by Black Duck.

How we deliver it

From first scan to audit-ready evidence

Scope

Which products and suppliers fall under the CRA or NIS2, and what you already have in place.

CRA readiness call

Scan

Black Duck analysis of your codebases, containers and supplier binaries; first SBOMs.

First results

Fix

Prioritised remediation of vulnerable and non-compliant components with your developers.

With your teams

Embed

SBOM generation and policy gates in CI/CD, as part of our DevSecOps practice.

Every release

Prove

Vulnerability-handling process, reporting playbooks and evidence packs for CRA and NIS2 audits.

Ongoing

Questions

Frequently asked

Does the CRA apply to us?

It applies to manufacturers, importers and distributors of products with digital elements placed on the EU market, including software. We help you work out which of your products are in scope and in which category.

We buy software rather than build it. Does this still help?

Yes. NIS2 expects you to manage supply-chain risk. Black Duck binary analysis and supplier SBOM reviews show what is inside the software you buy.

Can you run it for us?

Yes — as a one-off assessment or as an ongoing service integrated into your pipelines, with regular reporting.

Get ready for the Cyber Resilience Act

Start with a readiness call: we'll map your products to the CRA and show where Black Duck closes the gaps.

Book a Start Here call Governance, Risk & Compliance