Product workflow
One Product-Version record for the evidence behind a release.
CRA Ledger connects product identity, SBOM scope, findings review, human decisions, remediation context, release sign-off, retained evidence, and CRA reporting records in one operating workflow.
Conceptual record model
Product Version 4.8.2
A stable release identity keeps the evidence behind a product decision connected and reviewable.
Primary SBOM
Evidence scope linked
Findings review
Components and vulnerability context
Human decisions
Rationale, owner, and timestamp
Remediation context
Treatment work, accepted-risk context, and release sign-off
Operating model
Product Version is the anchor, not an afterthought.
Start with the release you need to understand. Everything else is connected to its evidence scope, review state, decision and remediation history, and release context.
Product Version
Release identity and lifecycle scope
SBOM
Linked source and primary artifact
Findings
Component and vulnerability context
Human Review
Rationale, owner, and disposition
Decision
Recorded rationale, owner, and disposition
Remediation
Treatment work, accepted-risk context, owner, and supporting evidence
Evidence Pack
Retained, versioned decision and sign-off record
What stays connected
A focused workflow for teams that need the evidence trail to hold together.
The product is organized around the decisions teams already make during release and vulnerability review, not around a catalogue of disconnected compliance features.
Product identity and scope
Start with the release or Product Version that the evidence describes, then link the relevant SBOMs and supporting context.
Findings and human review
Keep vulnerability findings, rationale, ownership, dispositions, and timestamps connected to the release under review.
Decisions and remediation context
Record remediation work, accepted-risk context, ownership, and supporting evidence in the Product-Version record before producing retained evidence output.
History and governance
Preserve review history, role-aware ownership, audit activity, and tenant-scoped records for later review.
Evidence Pack
Retain the evidence state behind a release decision.
Generate a retained Product-Version Evidence Pack after review and sign-off. Earlier pack versions remain available so teams can understand what was captured at each point in time.
The pack supports reviewability, release discussions, and evidence continuity. It does not certify compliance or replace formal assessment.
See security and trust principlesEvidence output
Product-Version Evidence Pack
A retained record of what the team reviewed, decided, and signed off for a release.
Product context
Product Version, release identity, and linked scope
Review history
Findings, rationale, owners, and timestamps
Release decision
Sign-off context and retained output
CRA Reporting connection
Reporting records stay connected to product evidence, while judgment stays human.
CRA Ledger helps teams organize CRA Article 14 reporting records around the Product Version. Record awareness timestamps, reportability decisions, milestone state, external references, corrective-measure availability, and close/reopen history. Known exploited vulnerability signals and recorded severe security incidents can flag affected Product Versions for Needs assessment and human CRA Reporting review. CRA Ledger can match CISA Known Exploited Vulnerabilities (KEV) signals only against vulnerability findings already associated with Product Versions.
Security event / vulnerability
Start from a Product Version and source context
Awareness timestamp
Record when the team became aware
Human determination
Record reportable, not reportable, or needs review
Reporting milestones
Track required deadlines and milestone state
External submission record
Retain references and submission timestamps
Corrective measure
Record when a corrective measure is available
Close / reopen history
Preserve the reason and decision trail
Current product proof
Operational visibility for teams running the workflow.
Use the operations console to see risk posture, review progress, findings, alerts, and operational health while Product-Version records hold the release-specific evidence.
Current product proof
Operations console preview
Governance
Designed for controlled review, not black-box compliance claims.
Tenant boundaries, role-aware access, audit activity, retained outputs, and explicit human ownership are part of the operating model.
Next step
See one Product Version move from SBOM to retained evidence.
Bring a real workflow question or a controlled sample scope. We will show the evidence record, review flow, and reporting connection.