Compliance Articles
All GeekWala articles in the Compliance category.
DORA ICT Third-Party Risk & Open-Source Dependencies
DORA's ICT risk-management and third-party-risk articles don't mention open-source dependencies by name, but they cover them. This guide translates Articles 6, 28, and 30 into a concrete scanning baseline: inventory, SBOM, exploitability triage, and reporting.
NIS2 Supply Chain Security Requirements Explained
NIS2 Article 21 requires essential and important entities to secure their supply chain, including software dependencies. This guide translates Article 21(2)(d) and (e) into concrete evidence: SBOMs, scan cadence, and vulnerability-handling records.
EU CRA Day One: Your First 24 Hours
Most CRA coverage is written for the person deciding whether the regulation applies. This is for the engineer who gets paged at 09:14 with 24 hours on the clock: the three deadlines, a ready-to-use early-warning template, and the mistakes that blow the window.
Dependency License Compliance Guide
License compliance is the other reason organizations buy SCA, alongside vulnerabilities. This guide covers permissive vs copyleft licenses, the AGPL network clause every SaaS team should know, and how to audit what your dependency tree actually licenses you to do.
EU CRA CE Marking: The December 11, 2027 Deadline
September 2026 is the CRA's reporting deadline. December 11, 2027 is the bigger one: mandatory CE marking, essential cybersecurity requirements, and formal conformity assessment for every in-scope product. What changes, which tier your product falls into, and how to prepare.
EU CRA Reporting Obligations: Article 14 Now in Force
Most EU Cyber Resilience Act coverage points at the December 2027 deadline. The obligation that landed first — 24-hour reporting of actively exploited vulnerabilities — has applied since September 11, 2026. Here's how the reporting regime works and who it applies to.
SBOM Scanning Tools 2026: EU CRA Guide
EU CRA's September 2026 deadline requires 24-hour reporting of actively exploited vulnerabilities. You can't meet that deadline without SBOM tooling. This guide covers which tools generate and scan SBOMs, handle EU CRA workflows, and fit your team size and budget.
SBOM Requirements 2026: Developer Checklist
The EU CRA vulnerability reporting deadline is September 2026. Here's the checklist your team needs to be ready — organized into two phases with specific action items for each.
SBOM Scanning and the EU Cyber Resilience Act
Starting September 2026, the EU Cyber Resilience Act requires vulnerability and incident reporting for software sold in Europe. By December 2027, you'll need a machine-readable Software Bill of Materials. If your software has open-source dependencies — and it does — this directly affects you.