How to align with the CRA through Static Analysis
The EU Cyber Resilience Act’s Article 14 reporting obligations are already in force. The full secure-by-design requirements follow in December 2027.
In this talk, Mark Hermeling (AdaCore) breaks down what the CRA actually asks of engineering teams and how static application security testing (SAST) fits in. No exotic technology required: the CRA wants a disciplined, documented, security-aware development process, and this session shows what that looks like in practice.
What you’ll learn:
- What Annex I and Article 14 require, in plain language
- Why not every static analysis warning is a reportable vulnerability
- How to scope your attack surface and split SAST vs SBOM coverage
- Building CI/CD with analysis on every change
- How CodeSonar fits into a CRA-compliant workflow
- A practical to-do list if you’re starting from zero
Want to learn more? Read our blog discussing this topic!
Author
Mark Hermeling
Mark has over 25 years’ experience in software development tools for high-integrity, secure, embedded and real-time systems across automotive, aerospace, defence and industrial domains. As Head of Technical Marketing at AdaCore, he links technical capabilities to business value and is a regular author and speaker on on topics ranging from the software development lifecycle, DevSecOps to formal methods and software verification.
