CRA Supply Chain Due Diligence: Infrastructure for Vendor and Component Assessment

Your product contains a third-party Bluetooth stack, an open-source TLS library, a commercial RTOS, and firmware from your chipset vendor. Under the CRA, a vulnerability in ANY of these is your problem. Supply chain due diligence isn't a checkbox — it's continuous infrastructure.

Component Lifecycle Tracking

• Component inventory — Every third-party component cataloged with: vendor, version, license, support status, CRA classification
• Vendor assessment — CRA readiness evaluation of all component suppliers
• Contractual requirements — Vulnerability notification SLAs, patch availability commitments, SBOM provision
• End-of-life monitoring — Automated alerts when components approach or reach end-of-support

Continuous Vendor Monitoring

Don't assess vendors once and forget. Build monitoring infrastructure that tracks: vendor security advisory publication frequency and quality, average time-to-patch for reported vulnerabilities, component update availability and compatibility, vendor financial health and business continuity risk.

Component Security Testing

Don't trust vendor claims. Test components yourself: binary analysis of firmware and libraries, interface fuzzing for third-party APIs, network behavior analysis for connected components, configuration audit against CRA secure-default requirements.

Alternative Component Strategy

For every critical third-party component, identify an alternative. If your Bluetooth stack vendor fails CRA conformity, you need a migration path. This isn't paranoia — it's the operational resilience that CRA and DORA both require.