# Cyber Resilience Act **URL:** \ **Category:** General\ **Created:** [March 17, 2025, 7:02am UTC](https://forums.balena.io/t/cyber-resilience-act/373877 "2025-03-17T07:02:16Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![wooyay](https://avatars.discourse-cdn.com/v4/letter/w/8c91f0/32.png) [@wooyay](https://forums.balena.io/u/wooyay)\ **Post date:** [March 17, 2025, 7:02am UTC](https://forums.balena.io/t/cyber-resilience-act/373877/1 "2025-03-17T07:02:16Z")
Hello, I would like to know what are the plans to get Balena compliant with european Cyber Resilience Act. - Is there documentation or guidelines on how balena can be used in CRA environments? - Can I download the SBOM for a specific balena release? - If not, is there a time plan on when everything necessary for CRA is available? Thank you! ---
**Author:** ![rmorillo24](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/rmorillo24/32/10359_2.png) [@rmorillo24](https://forums.balena.io/u/rmorillo24)\ **Post date:** [March 18, 2025, 8:24am UTC](https://forums.balena.io/t/cyber-resilience-act/373877/3 "2025-03-18T08:24:33Z")
Hi Wooyay, We are actively working on CRA, being very conscious that it affects us and our users. So our approach is dual: a) to become CRA compliant, and b) enable our users to be compliant We are working on different lines right now: - We will release a guide that summarises what the CRA is about and how it relates to balena - We currently have SBOM generation on an alpha mode. The goal is to make SBOMs available via the API, in some format that will enable you to generate your own reports. - Same with VCEs - We are discussing how/if we should enable SBOM/VCE scanning for our user’s docker images. We will probably do this in a 2-step approach since we don’t know if this is even a demand - We are planning to join some working groups that will help us understand the regulation, collaborate on standards, etc. - We are making changes to some of the features in balenaCloud and balenaOS to make them serve to the CRA With these on-going tasks, plus some others that we will require, we don’t have a specific timeline. But just to mention that the CRA and security as a whole is a priority and we will be releasing features. We’ll keep you updated! ---
**Author:** ![bartjanszoon](https://avatars.discourse-cdn.com/v4/letter/b/ce73a5/32.png) [@bartjanszoon](https://forums.balena.io/u/bartjanszoon)\ **Post date:** [April 23, 2025, 7:50am UTC](https://forums.balena.io/t/cyber-resilience-act/373877/4 "2025-04-23T07:50:00Z")
Hi, I second this request, especially the part on downloading SBOM of BalenaOS and BalenaSupervisor. Please keep us updated. Thank you! ---
**Author:** ![rmorillo24](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/rmorillo24/32/10359_2.png) [@rmorillo24](https://forums.balena.io/u/rmorillo24)\ **Post date:** [April 23, 2025, 12:29pm UTC](https://forums.balena.io/t/cyber-resilience-act/373877/5 "2025-04-23T12:29:08Z")
Thank you [bartjanszoon](https://forums.balena.io/u/bartjanszoon). We’ll be releasing some more information about our intentions, but indeed, downloading SBOMs will be possible. ---
**Author:** ![mpous](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/mpous/32/4742_2.png) [@mpous](https://forums.balena.io/u/mpous)\ **Post date:** [May 9, 2025, 10:41am UTC](https://forums.balena.io/t/cyber-resilience-act/373877/6 "2025-05-09T10:41:48Z")
@bartjanszoon @wooyay hello! We have created the [CRA forums section](https://forums.balena.io/c/eu-cyber-resiliance-act-cra/98) to start discussing the next steps of balena with the CRA. Happy to see you asking the questions there!