Hello,
I’m developing a version of Linux for a Colibri iMX8QXP board using Yocto Scarthgap with your BSP.
I need to document the compatibility of the produced Linux system with the EU Cyber Resilience Act (CRA) requirements.
Are there any documents or web pages available that describe how the Toradex solution is compatible with the CRA?
Thanks for your help.
Regards
Flavio Gobber
Hello @flavio,
The topic of CRA compliance is quite complicated.
I would recommend that you read a bit more into the high-level requirements on the following page: Requirements to comply with EU CRA
How our base BSP can help you with CRA compliance is by being maintained and up to date.
However, to be able to verify that your OS and application are actually not affected by vulnerabilities, the burden is on you to monitor the software components which are being used.
We cover SBOM generation in the following page: SBOM Reports | Toradex Developer Center
Having an SBOM is the first step, but parsing through the SBOM and comparing to vulnerability databases is the most demanding part. There are open source tools that help make this simpler, but it is still a lot of work.
Torizon OS is made to help with the CRA, so I would also recommend that you take a look at the following page to learn more: EU Cyber Resilience Act (CRA) | European Cyber Resilience Act
Other aspects, such as secure boot, are not strictly required but somewhat implied in the CRA.
For that we offer meta-toradex-security, which makes enabling secure boot and other security-relevant features much easier on both our BSP and Torizon OS.
Best Regards,
Bruno
