Cyber Resilience Act

General
1

Hello,
I would like to know what are the plans to get Balena compliant with european Cyber Resilience Act.

  • Is there documentation or guidelines on how balena can be used in CRA environments?
  • Can I download the SBOM for a specific balena release?
  • If not, is there a time plan on when everything necessary for CRA is available?

Thank you!

3

Hi Wooyay,

We are actively working on CRA, being very conscious that it affects us and our users. So our approach is dual: a) to become CRA compliant, and b) enable our users to be compliant

We are working on different lines right now:

  • We will release a guide that summarises what the CRA is about and how it relates to balena
  • We currently have SBOM generation on an alpha mode. The goal is to make SBOMs available via the API, in some format that will enable you to generate your own reports.
  • Same with VCEs
  • We are discussing how/if we should enable SBOM/VCE scanning for our user’s docker images. We will probably do this in a 2-step approach since we don’t know if this is even a demand
  • We are planning to join some working groups that will help us understand the regulation, collaborate on standards, etc.
  • We are making changes to some of the features in balenaCloud and balenaOS to make them serve to the CRA

With these on-going tasks, plus some others that we will require, we don’t have a specific timeline. But just to mention that the CRA and security as a whole is a priority and we will be releasing features.
We’ll keep you updated!

1 Like