Trust Assessment.
A scoped review of inventory, SBOM and evidence for an agreed release.
When customers, audits or the Cyber Resilience Act require reliable evidence, a self-assessment is not enough. In the Trust Assessment we review the agreed scope based on the artefacts provided and record evidence, findings, review limits and actions in the Trust Report.
- Scope
- One agreed product or release
- Result
- Trust Report
- Basis
- Artefacts and evidence provided
- Price
- After scoping, in the quote
When orientation needs to become evidence.
Customer request
A customer asks for a current SBOM or evidence of vulnerability handling for a specific release.
Audit or procurement
For an audit, tender or supplier assessment you need a traceable account of inventory, findings and open points.
CRA preparation
You want to know where your release stands on SBOM, vulnerability handling and evidence before the requirements fully apply from December 2027.
The scope is fixed before we begin.
Each assessment is scoped individually. The quote states:
- products and releases in scope
- artefacts, repositories and SBOM types to be reviewed
- permissions, data classes and exchange channels
- sources, tools and depth of review
- deadlines, price and explicit exclusions
What we need from you.
- a technical contact and short approval paths
- the agreed artefacts, SBOMs or access via an agreed exchange channel
- information on versions, build and deployment environment where needed for the scope
- decisions on priorities and actions that only you can take
Structure of the Trust Report.
The Trust Report follows a fixed structure so that management, engineering and compliance work from the same basis.
- 01
Management summary
Occasion, evidenced results, key risks, known gaps and recommended next steps. No blanket trust rating.
- 02
Scope, method and limits
What was reviewed, with what, under which permissions, and what was explicitly not reviewed.
- 03
Identities and evidence
Release, artefact and SBOM identities with checksums, tool and data versions and timestamps.
- 04
Inventory and coverage
Known components, direct and transitive dependencies, artefacts actually reviewed and areas not covered.
- 05
Security findings
Per finding: component, source, evidence, relevance, priority, owner and status. A finding is not confirmed exploitability.
- 06
Provenance and integrity
Sources, signatures, checksums and build evidence, separated into reviewed, not reviewed and not available.
- 07
OSS and licence governance
Licence findings and open expert assessments. No legal advice and no blanket compliance certificate.
- 08
Action plan
Prioritised actions with responsible role, date and dependencies.
- 09
Re-review
If agreed: method, status and result of the re-review; re-reviews not carried out remain marked as open.
- 10
Evidence register
References to SBOMs, checksums, tool and data versions and rules on access and retention.
Four steps.
- 01
Introductory call
Clarify occasion, product and desired result. A prior Trust Check helps but is not required.
- 02
Scoping and quote
Agree scope, contribution, exchange channels, deadlines and price in writing.
- 03
Review
Review the artefacts and evidence provided within the agreed scope and document findings.
- 04
Report and handover
Hand over the Trust Report after expert review, discuss actions and agree a re-review on request.
What the Trust Assessment is not.
- not a certificate and no CRA or NIS2 conformity guarantee
- not a penetration test or a complete secure code audit
- not legal advice
- no statement on areas outside the agreed scope; not checked does not mean secure
Upstream Services for implementation.
For the actions from the report you can then commission Upstream Services: governance and SBOM management, vulnerability triage or patch research. This is optional and agreed separately.
To the Upstream ServicesFrequently asked questions.
What does a Trust Assessment cost?
The price depends on the scope, for example the number and type of artefacts and the depth of review. After the introductory call you receive a scoped quote with scope, contribution, deadlines and price.
Do I have to do the Trust Check first?
No. The free Trust Check gives initial orientation and helps with scoping, but it is not a prerequisite.
Do you need our source code?
Not necessarily. What is reviewed is defined during scoping; SBOMs, build artefacts and existing evidence are often sufficient. We only exchange confidential data via a channel agreed in advance.
Is the Trust Report a certificate?
No. It documents evidence, findings, review limits and actions for the agreed scope. It does not replace a certification or a legal conformity assessment.
Let's clarify the scope.
In the introductory call we clarify occasion, product and a sensible review scope. You then receive a scoped quote.