---
title: "Discussion on \"The CRA's 24-hour clock is a cross-repo question. Your SBOM answers a different one.\" | Hashnode"
description: "Discussion on \"The CRA's 24-hour clock is a cross-repo question. Your SBOM answers a different one.\". The CRA's 24-hour reporting clock asks which products ship an exploited component. Your SBOM lists what is inside one artifact. Those are different questions, and the gap between them is a cross-repo IaC dependency graph."
url: "https://hashnode.com/posts/the-cra-s-24-hour-clock-is-a-cross-repo-question-your-sbom-answers-a-different-one/6a1f2a13545c8a206ce556bd"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [The CRA's 24-hour clock is a cross-repo question. Your SBOM answers a different one.](https://riftmap.hashnode.dev/the-cra-s-24-hour-clock-is-a-cross-repo-question-your-sbom-answers-a-different-one?utm_source=hashnode&utm_medium=feed)

The CRA's 24-hour reporting clock asks which products ship an exploited component. Your SBOM lists what is inside one artifact. Those are different questions, and the gap between them is a cross-repo IaC dependency graph.

Jun 2 · 16 min read · riftmap.hashnode.dev  
Read the article

-   [#sbom](https://hashnode.com/tag/sbom)
-   [#cross-repo-dependencies](https://hashnode.com/tag/cross-repo-dependencies)
-   [#supply-chain-security](https://hashnode.com/tag/supply-chain-security)
-   [#infrastructure](https://hashnode.com/tag/infrastructure)
-   [#blast-radius](https://hashnode.com/tag/blast-radius)
-   [#compliance](https://hashnode.com/tag/compliance)

## Written by

[Daniel Westgaard](https://hashnode.com/@danielw)

@danielw · Oslo, Norway

  
[View profile](https://hashnode.com/@danielw)

Developer with a passion for building and development - currently building Riftmap, https://riftmap.dev

Developer with a passion for building and development. Currently building Riftmap - https://riftmap.dev

## Responses

Markdown supported · ⌘↵ to post

No responses yet.