Remediation evidence tracking
Keep records of patches applied, testing done, and verify that vulnerabilities are resolved in the build context. Retain validation context to support readiness reviews.
Remediation checklist
Verify these items for each patch release:
Vulnerability CVE mapped to component.
Patch version documented.
Remediation owner assigned.
Validation checks completed.
Retained decision log updated.
Product alignment
How CRA Ledger maps this into a workflow
Product-version record
Released versions are anchored with metadata.
SBOM retained
Original formats are retained with source-artifact context.
Vulnerability review tracked
CVE triage decisions document ownership.
Remediation status connected
Fix updates and SLA tracking stay visible.
Decisions & timestamps preserved
Provenance is recorded for every decision.
Readiness evidence summarized
Evidence summaries keep output context reviewable.
Notice
Operational guidance only. Confirm product scope and CRA duties with official sources and advisers.
CRA Ledger supports readiness workflows and evidence organization. It does not guarantee compliance or replace legal advice.
Related resources