HeroDevs ads

An audit flags an end-of-life component. The upstream project stopped patching it two years ago. The migration is a two-quarter project nobody has scoped. This session covers what the deadlines require in practice, the evidence a reviewer accepts, and the options when the window is short. CRA, NIS2, DORA, and how the same requests read under FedRAMP and NIST 800-53. September 17, 45 minutes. Recording and compliance white paper go to everyone who registers.

Every security review now asks the same question about end-of-life components. Most teams cannot answer it in a way a reviewer accepts. Erin Hannaford and Rob Nalen walk through what CRA, NIS2, and DORA require once a component is past end of life, and what evidence actually closes the finding. 45 minutes, September 17. Cannot make it live? Register anyway and we will send the recording and our security compliance white paper.

CRA reporting duties for actively exploited vulnerabilities apply from September 2026. Full conformity obligations follow in December 2027. If your migration window extends past those dates, an unsupported component stops being a backlog item and becomes a control gap you have to answer for in a conformity assessment. 45 minutes on September 17 with Erin Hannaford and Rob Nalen. Register and we will send the recording and the compliance white paper either way.

From September 11, an actively exploited vulnerability in a product you've placed on the EU market starts a clock. Early warning in 24 hours. Full notification in 72. A final report within 14 days of a fix being available. Most teams can hit those windows. Fewer can say what they'd be reporting on.

Four sections, sixteen questions, every one tied to the article behind it. A score, a breakdown by section, and your gaps in the order you should fix them. The CRA applies to any company placing products with digital elements on the EU market. Where you're headquartered doesn't change that.

Sixteen questions across four areas, each one tied to the statutory text behind it. You get a score, your gaps by section, and what to fix first. Most teams find they're further along on policy than on reporting. Worth knowing which before September 11.