We are currently preparing our Cyber Resilience Act (CRA) compliance processes and are integrating automated vulnerability management into our SBOM workflow.
We have already reviewed Nordic's official CRA and security-related information, including the myNordic portal, security advisory process, and the available security notification mechanisms. We also attempted to configure security notifications for the Nordic products used in our devices.
However, during the setup process we encountered an error in the myNordic portal, and some of the software components we currently use, such as legacy SoftDevices, could not be located or selected. As a result, we are currently unable to fully rely on the notification service for monitoring security information related to all Nordic software components deployed in our products.
See screenshot below
See screenshot below
More importantly, our vulnerability management processes are designed to be largely automated and integrated with our SBOM tooling. Email notifications and portal-based communication can help satisfy communication requirements, but they do not integrate well into automated vulnerability monitoring and compliance workflows.
For third-party software components, we therefore primarily rely on standardized and machine-readable vulnerability information such as:
- CVEs
- CPEs
- CSAF
- VEX
- Security advisory feeds
These artefacts can be automatically consumed by vulnerability management platforms such as Dependency-Track and are essential for establishing a scalable and auditable CRA-compliant vulnerability management process.
The main challenge for us is therefore not the remediation of vulnerabilities once they become known, but ensuring reliable, timely, and automated awareness whenever vulnerabilities affecting Nordic proprietary software components are identified.
Are there plans to provide machine-readable advisory formats in the future?
