CRA SBOM: Software and Firmware to Track in Industrial PCs

Do you know how much software and firmware is actually inside an industrial PC?

The EU Cyber Resilience Act (CRA) will apply in full from 11 December 2027. Annex I Part II of the CRA (vulnerability handling requirements) requires manufacturers to identify and document the components and vulnerabilities in their products. This includes drawing up an SBOM (software bill of materials) as the basis for vulnerability management and impact analysis.

📌 Three key points on CRA SBOMs

✅ A commonly used, machine-readable format: The SBOM must cover at least the top-level dependencies of the product. The CRA does not prescribe a format; CycloneDX and SPDX are commonly used in the industry. The Commission may later specify the format and content through implementing acts.
✅ Part of the technical documentation: The SBOM must be included in the technical documentation, but it does not have to be made public. Market surveillance authorities may request it with a reasoned request.
✅ Supporting vulnerability management: Knowing your software components and versions helps you quickly identify affected products.

🔍 What should be inventoried in an industrial PC (IPC)?

The software and firmware in an industrial PC often come from different departments and suppliers:
🔹 BIOS/UEFI: low-level system firmware
🔹 BMC: remote management controller firmware
🔹 Windows/Linux: operating system and related packages
🔹 Drivers/utilities: hardware drivers and management tools
🔹 Wi-Fi/LTE modules: third-party communication module firmware
Other products face the same challenge:
🌐 Networking equipment: Linux firmware, open-source packages and third-party components.
🔋 Energy storage systems (ESS): software and firmware for the BMS, PCS, EMS, etc.

💡 How can companies set up SBOM management?

We recommend starting with four steps:
1️⃣ Inventory components: Take stock of the software, firmware and third-party components used in the product.
2️⃣ Generate SBOMs: Use tools to generate SBOMs in CycloneDX/SPDX format.
3️⃣ Link to versions: Link each SBOM to product models, firmware versions and shipped versions.
4️⃣ Track vulnerabilities: Continuously track component vulnerabilities and quickly identify affected product versions.
⚠️ The value of an SBOM is not just producing a list. What matters more is ongoing maintenance, version traceability and vulnerability impact analysis.

When a security vulnerability is disclosed in an open-source component, can your company answer straight away: “Which products use this component? Which shipped versions are affected?” That is a key purpose of setting up SBOM management.

👉 Want to plan SBOM and product version traceability that suits your company?

Get in touch with Anselm (安盛資訊).

📩 Contact Anselm: sales@anselm.com.tw

Further reading: EU CRA series | Previous article: EU CRA Essential Cybersecurity Requirements: From Default Passwords to Security Updates | Next article: EU CRA Vulnerability Reporting: 24-Hour Early Warning and 72-Hour Notification

This article is for general information only and does not constitute legal advice.