Gitar is joining Sonar
Ctrlk
Sonar
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Cyber Resilience Act capability mapping

Maps the EU Cyber Resilience Act (CRA) requirements to SonarQube capabilities, including quality gates, Advanced Security, SBOM export, and dependency risk review.

This page maps supported EU Cyber Resilience Act requirements to SonarQube capabilities.

This mapping shows how SonarQube capabilities that are already part of a normal development workflow, including code analysis, pull request checks, quality gates, dependency analysis, and issue tracking, can be configured to strengthen CRA-related controls and provide evidence for compliance and cybersecurity processes.

Using SonarQube as CRA supporting evidence

To use SonarQube outputs as part of a CRA evidence process:

  1. Analyze all code continuously in CI and on pull requests. See CI-based analysis and pull request analysis for SonarQube Cloud, or CI tools and pull request analysis for SonarQube Server.

  2. Use quality profiles (SonarQube Cloud) or quality profiles (SonarQube Server) to define the security, reliability, and maintainability checks applied to each project.

  3. Use quality gates (SonarQube Cloud) or quality gates (SonarQube Server) to enforce release and pull request controls.

  4. Use Advanced Security (SonarQube Cloud) or Advanced Security (SonarQube Server) for SCA, Advanced SAST, dependency risks, and SBOM export.

  5. Review dependencies (SonarQube Cloud) or dependencies (SonarQube Server), export SBOMs at release time, and store release SBOMs with the manufacturer's release records.

  6. Review and assign dependency risks (SonarQube Cloud) or dependency risks (SonarQube Server), update statuses, add justification where needed, and use dependency risk reports as evidence.

  7. Import external findings through SARIF reports (SonarQube Cloud) or SARIF reports (SonarQube Server) where other security tools are part of the workflow.

  8. Use AI CodeFix or the SonarQube Remediation Agent, where available, to help prepare fixes for eligible issues.

CRA capability mapping

This page focuses on CRA requirements where SonarQube can provide controls and evidence through code analysis, dependency analysis, pull request checks, quality gates, issue workflows, and remediation tracking. Manufacturers can combine these outputs with their broader cybersecurity, release, legal, and customer communication processes to support their overall CRA compliance program.

Annex I, Part I, point 2(a): No known exploitable vulnerabilities

SonarQube supports this requirement by identifying vulnerabilities and exploitable weaknesses in first-party code and third-party dependencies before release, and by enforcing quality gates on branches and pull requests. This helps manufacturers reduce the risk of shipping products with known exploitable weaknesses and build release control into the SDLC.

Annex I, Part I, point 2(b): Secure by default configuration

SonarQube supports this requirement by detecting insecure configurations or defaults, such as hardcoded secrets, weak cryptographic parameters, or permissive privileges in all kinds of code, application settings, and Infrastructure as Code. This helps manufacturers make secure configuration repeatable, enforceable, and traceable across the SDLC.

Annex I, Part I, point 2(d): Secure access control

SonarQube supports this requirement by analyzing all access control, authentication, and privilege management functionalities in code for security weaknesses, and by blocking related security issues via quality gates. This helps manufacturers establish a control mechanism that ensures protection from unauthorized access.

Annex I, Part I, point 2(e): Secure data transmission

SonarQube supports this requirement by detecting cryptography issues, such as missing data encryption, the use of weak ciphers or protocols, or insecure cryptographic parameters. This helps manufacturers protect the confidentiality of processed data and confirm it's encrypted using state-of-the-art mechanisms.

Annex I, Part I, point 2(f): Integrity of data, commands, programs, and configuration

SonarQube supports this requirement by identifying critical security vulnerabilities, such as command injection, code injection, SQL injection, prompt injection, or arbitrary file writes/reads that could lead to a security breach and put the integrity of applications, data, or deployment environments at risk. This helps manufacturers strengthen integrity protections against unauthorized manipulations or modifications.

Annex I, Part I, point 2(h): Protect against denial-of-service attacks

SonarQube supports this requirement by checking for over 1,500 different types of reliability issues. These issues can slow down or even crash the application, and can be effectively used in denial-of-service attacks. Detecting and remediating these issues helps manufacturers protect against these types of attacks.

Annex I, Part I, point 2(j): Limiting attack surfaces, including external interfaces

SonarQube supports this requirement by helping manufacturers review code, Infrastructure as Code, and dependencies for issues that may expose externally reachable functionality, insecure interfaces, or exploitable paths. With SAST, taint analysis, IaC scanning, secrets detection, SCA, Advanced SAST, and quality gates in CI and pull requests, teams can make attack-surface review repeatable and traceable across the SDLC.

Annex I, Part II, point 1: Identification and documentation of vulnerabilities and components

SonarQube supports this requirement by performing software composition analysis, maintaining dependency and risk inventories, and exporting SBOMs in standard formats. This helps manufacturers document product composition and track vulnerability exposure across the software supply chain.

Annex I, Part II, point 2: Addressing and remediating vulnerabilities without delay

SonarQube supports this requirement by helping manufacturers detect, prioritize, and remediate vulnerabilities and dependency risks during development. With SCA, quality gates, IDE and MCP integration, AI CodeFix, and the SonarQube Remediation Agent where available, teams can fix issues as code is written, helping reduce the time between detection and remediation across the SDLC.

Annex I, Part II, point 3: Effective and regular tests and reviews

SonarQube supports this requirement by analyzing code continuously in CI, on branches, and on pull requests, and by importing external findings where needed. This helps manufacturers make application security review repeatable, continuous, and traceable across the SDLC.

Annex I, Part II, point 6: Sharing vulnerability information

SonarQube supports this requirement by providing security reports that summarize all detected vulnerabilities in first-party code and third-party components, including a CRA-specific security report. This helps manufacturers facilitate the sharing of information about potential vulnerabilities in their products, or the lack thereof.

Article 13(2) and 13(3): Cybersecurity risk assessment

SonarQube supports the product cybersecurity risk assessment by providing continuously updated evidence on code vulnerabilities, security hotspots, dependency risks, and remediation status. This helps manufacturers strengthen the software and software-supply-chain inputs to a documented, living risk assessment.

Article 13(5): Due diligence on third-party components

SonarQube supports this requirement by identifying third-party software dependencies, highlighting associated vulnerability and license-policy risks, and providing an option to export SBOMs for review. This helps manufacturers assess whether integrated components introduce unacceptable cybersecurity risk before and after integration.

Article 13(6) and 13(7): Component vulnerability handling and documentation

SonarQube supports this requirement by helping teams detect dependency risks, document relevant findings, assign and track review and remediation status, and maintain issue and dependency records over time. For dependency vulnerabilities, SonarQube also provides fix guidance such as affected versions, complete or partial fixed versions, and upgrade information. This helps manufacturers build a more structured process for documenting software vulnerabilities and feeding newly discovered issues back into product security reviews.

Related pages

PreviousSonarQube integrations

Last updated

Was this helpful?