# Softwsp

> Firmware and machine cybersecurity for device makers and machine builders (EU Cyber Resilience Act, Machinery Regulation, EN 18031). Softwsp is a brand of Netbase JSC.

## Services
- [Device firmware security: find the problems, then fix them](https://softwsp.com/services/device-firmware-security/): Firmware scan, SBOM and vulnerability report for device makers and brands, with optional remediation, maintenance and monitoring.
- [Machine builders: know what is inside your machines](https://softwsp.com/services/machine-builders/): A report on the digital components inside one machine line and the published vulnerabilities that affect them, within 72 hours.
- [OT Snapshot: see what is really on your shop-floor network](https://softwsp.com/services/ot-snapshot/): Record shop-floor traffic from a mirror port, upload it, and receive a device inventory, vulnerabilities and a map of remote access.
- [PSIRT as a service: a vulnerability process you do not have to staff](https://softwsp.com/services/psirt/): An outsourced vulnerability intake and response process for device makers, including support for CRA early-warning and incident reports.

## Guides
- [CRA Annex I explained: essential cybersecurity requirements in plain English](https://softwsp.com/guides/cra-annex-i-explained/): A plain-English walk through Cyber Resilience Act Annex I: the product requirements in Part I and the 8 vulnerability handling duties in Part II.
- [CRA checklist for device makers and embedded firmware teams](https://softwsp.com/guides/cra-checklist-device-makers/): A practical Cyber Resilience Act checklist for embedded and firmware teams: what to do before 11 December 2027, and what is already due.
- [CRA vulnerability reporting: the 24-hour early warning, 72-hour notification and final report](https://softwsp.com/guides/cra-vulnerability-reporting-24h/): How CRA Article 14 reporting works: 24-hour early warning, 72-hour notification, final report, the ENISA Single Reporting Platform and what to prepare.
- [Cyber Resilience Act requirements: a guide for device and firmware makers](https://softwsp.com/guides/cyber-resilience-act/): What the EU Cyber Resilience Act requires from device makers: scope, roles, CRA deadlines, Annex I, product classes, fines and first steps.
- [EN 18031 and the RED delegated act: a guide for firmware teams](https://softwsp.com/guides/en-18031/): EN 18031-1, -2 and -3 under the RED Delegated Regulation 2022/30: which RED article each covers, the restrictions in the OJ, and what firmware must do.
- [Firmware SBOM: how to build one when you only have the binary](https://softwsp.com/guides/firmware-sbom/): How to build an SBOM for embedded firmware from binaries, choose CycloneDX or SPDX, use VEX to cut noise, and meet the Cyber Resilience Act SBOM duty.
- [Machinery Regulation cybersecurity: what 2023/1230 means for machine builders](https://softwsp.com/guides/machinery-regulation-cybersecurity/): Cybersecurity in the EU Machinery Regulation 2023/1230: Annex III 1.1.9 and 1.2.1, the 20 January 2027 date, the link with the CRA, and next steps.
- [Vulnerability disclosure policy template and security.txt guide](https://softwsp.com/guides/vulnerability-disclosure-policy-template/): A free vulnerability disclosure policy template for device makers, plus how to publish security.txt (RFC 9116) with a ready example. Fits CRA and PSTI.

## Tools