Roja Monitor
CRA vulnerability monitoring tracks publicly known weaknesses across supported product releases. Monitor combines daily matching with engineer-led applicability decisions, reporting clocks and copy-ready drafts for the manufacturer to review and submit.
What you get.
- Daily monitoring of supported-release SBOMs
- Exploited-vulnerability alerts within one hour of detection
- Engineer-led triage: 10 / 40 / 120 findings monthly
- Documented applicability decisions and VEX
- 24h / 72h / final-report clock and draft submissions
- Portal with decisions and release history
What we need from you
A validated SBOM per supported release, a named incident contact and an agreed escalation path. Daily routine monitoring and one-hour exploited alerts describe different service cadences; neither is a promise of detecting every vulnerability.
What is outside the scope
Monitor does not include an implementation project, unlimited remediation hours, lab testing or submission on your behalf. Annual prepay gives two months free.
We document assumptions and evidence gaps rather than treating a scan as proof. Every accepted deliverable has an owner and a review step. Your engineers can inspect how findings relate to the release and which decisions still need confirmation.
Learn how this work fits the Cyber Resilience Act, the SBOM requirements and the Article 14 reporting process.
From access to usable evidence.
Set the boundary.
Identify the product family, supported versions, build inputs, data location and authorised access. Agree a named contact and the deliverables before we start.
Build the evidence.
Connect inventory to the release. Check findings with the people who know the code. Record decisions with article references and identify what needs engineering attention.
Make the handover useful.
Review the findings together. Separate verified facts from open questions. Assign owners, next actions and dates so the work survives the next product release.
Before we start.
Who remains responsible for compliance?
The manufacturer remains accountable for classification, conformity decisions, reporting and signing the declaration. We prepare evidence and drafts and help with engineering work.
Can we start without sharing all our source?
Yes. We agree the minimum inputs first. An existing SBOM or build output can be a starting point. If those inputs cannot support a conclusion, we document the limitation and agree what is needed next.
What are the payment terms?
Project work is 50% upfront, with the remainder according to the agreed milestones. Invoices are in EUR, excluding applicable VAT. Subscription scope and billing are agreed before activation.
Do you handle certification or penetration testing?
No. Accredited partner labs carry out testing, and notified bodies handle routes that require their involvement. Their fees and scope are agreed separately.
Let's see what your
product needs.
Start with a free Snapshot. We agree the inputs and authorisation before reviewing your build.