Blog category
Articles on Security & Compliance from our project work
Everything devs group has written on Security & Compliance, newest first.
Security and compliance at devs group do not mean checklists. They mean architecture: an incident log that evidences a reporting deadline, an audit trail that survives a subject access request, an SBOM pipeline that can answer retrospectively. The articles in this category show how regulatory obligations become technical components you can test and operate.
Security & Compliance
Implementing the CRA reporting obligation from 11.9.2026
Twenty-four hours to the first report. What you need in place in SBOM, monitoring and reporting chain before the Cyber Resilience Act applies.
What this category covers
The way in is the CRA reporting obligation that applies from 11 September 2026: twenty-four hours to the first report, and what has to be built in SBOM, monitoring and reporting chain before the Cyber Resilience Act takes effect, including where it differs from the Swiss ISG obligation. The article does its arithmetic in UTC timestamps rather than in fear.
The subject is closely tied to the artificial intelligence category, where the revDSG side of the same discipline lives: logging, retention, evidence. And it is tied to infrastructure: supply chain security starts in the CI/CD pipeline we describe on the Kubernetes and cloud infrastructure page.
If your own reporting chain currently consists of a Slack history, we build the technical side of compliance, from the log format to the pipeline, and we will tell you beforehand which part of it is obligation and which is ambition.
Every deadline and obligation in these articles has been checked against the legal text itself, with the article number and the date it was checked, and every technical recommendation comes with a working example: log formats to copy, pipeline steps to rebuild. Compliance content without code is not something this category does.
The category grows along the deadlines. After the CRA come the subjects whose dates fall next, always early enough that there is still time to build. The visible date under each title shows where an article stands.
If 11 September 2026 is already marked in your calendar, the CRA article contains the complete technical reporting chain to rebuild, from the NDJSON log through to the reporting platforms. And if rebuilding it is not an option, we will build it with you, including the question of whether your products fall within scope at all.
One pattern runs through all of these articles: the deadline is never the real problem. Start on the day it applies and you have already lost; but build the reporting chain properly once and the twenty-four hour obligation is met in passing, because the moment of awareness is captured by machine and the escalation follows the log rather than one person's memory. Compliance stops being a project and becomes a property of the system, and that is where each of these texts is trying to get you.
The effort is smaller than the ordinance texts suggest: the reporting chain from the CRA article is a day's work to rebuild, if logging and an incident process are already in place.
Start with the log format; most of the rest follows from it almost by itself.