Complass
Asset inventory, SBOM and vulnerability management: know what runs, and prove what you do
Monday, 7:40 a.m.: a new vulnerability is being actively exploited. Management asks "Are we affected?", a customer asks "Is your product affected?". Both answers depend on the same list.
NIS2 and the German BSI Act, the Cyber Resilience Act (CRA) and IEC 62443 require the same foundation from asset owners and manufacturers: an up-to-date inventory of systems, for manufacturers a software bill of materials (SBOM) per product version, and a traceable way of handling known vulnerabilities. The CRA makes the SBOM mandatory (Annex I Part II no. 1) and, since 11 Sep 2026, requires actively exploited vulnerabilities to be reported within 24 hours (Art. 14).
The whitepaper opens with two questions on the same Monday morning and from there explains what belongs in an asset inventory for IT and OT, what the CRA does and does not require of the SBOM, which sources deliver vulnerabilities (CVE, NVD, KEV, EPSS, EUVD, CSAF), why context matters more than the CVSS score, how VEX answers the question "affected or not?", how to deal with the end of vendor support and how to document licences and contracts with their deadlines. With a 10-step plan, a checklist and two practice examples.
Each implementation chapter includes a short "Implementation in Complass" box with a platform screenshot (decision W11); only features already live are named.
17 pages · Version 1.2 · as of 17.10.2026 · Author Marc Linden, Complass GmbH i. G.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.