CRA, NIS2, DORA: What Senior Java Engineers Must Deliver Before 2027
summary
EU Cyber Resilience Act forces production-grade SBOMs and vulnerability reporting by 11 December 2027, with auditors checking published SBOMs, vuln reports and remediation playbooks and penalties up to millions or a percentage of global turnover. Required practices include build SBOMs (not just runtime), reproducible builds, signed provenance and 5–8 year lifecycle traceability; recommended tools are CycloneDX with Maven/Gradle plugins, sigstore / cosign / Salsa for provenance, plus JReleaser and Sift for image SBOMs and vulnerability analysis.
AI-written summary · about
chapters (7)
- 0:00Introduction and context
- 6:28Cyber Resilience Act overview
- 17:06CRA core requirements
- 26:45SBOMs and documentation
- 37:50SBOM types and culture change
- 41:03Reproducible builds and tools
- 47:02Feedback and next steps
related talks
44mWhat does it take to deploy to production with confidence?
49mDeploying to production with confidence
53mThe EU CRA Readiness for Contributors and Maintainers : A Survival Toolkit
46mLinux Foundation Initiatives Supporting the Implementation of the EU Cyber Resilience Act
45mCyber Resilience Act: 36 Months to Prepare Your DevOps Pipelines
50mGame over or game changing? Why software development may never be the same again
01h 16mCybersecurity with CDF & OpenSSF Focus Group
36mSBOMs, VEX, and Kubernetes