Name: Firmware SBOM — Per-Image Analysis
Brand: CRM Sync
SKU: sbom-firmware-image
Price: 250.00 USD
Availability: InStock

Chip with pins — firmware SBOM analysis, monochrome line art

Firmware SBOM — Per-Image Analysis

$250.00

The parts-list for the device itself — not just the app that pairs with it. The EU rule scopes the firmware image, not only the companion app. This produces the parts-list for the image itself, and states honestly how it was made.

How it works

You provide the firmware image, or the build sources.
We produce the parts-list — from the build system where sources exist, or by analyzing the binary where they don't.
The method is written into the document; best-effort binary analysis is labeled as such, never passed off as build truth.

What makes it different

Most SBOM work covers the app and quietly skips the device firmware — the part the rule actually names. This covers the image, and is honest about how: a document you can stand behind, not one that overclaims.

Under the hood

Yocto or Zephyr build-time generation, or EMBA / cve-bin-tool binary reconstruction; method stated in the document; the image vaulted with AES-256-GCM and an Ed25519 certificate; registry-linked to its SHA-256 provenance.

Preview the vault wizard → — browse the Upload, Access, SBOM, Embed, and Vault tabs before you buy; it unlocks the moment your order is paid.

Open the Channel Wizard →

Mint an attributed link or QR for this product — preview it free in the modal; minting unlocks with the Channel Publish add-on.

A one-time, standards-compliant CycloneDX SBOM for a single firmware image — with the image vaulted under encryption.

What you get

✓A CycloneDX SBOM for one image — Yocto / Zephyr build generation, or EMBA / cve-bin-tool binary analysis — the method stated in the document.
✓The image vaulted — AES-256-GCM, certificate-tracked upload, grant-gated verified download.
✓A hash-chained access ledger — for the image, never a public file URL.

Under the CRA a connected device's firmware is in scope — the SBOM must cover the image, not just the companion app. Vendor images with no sources make that hard to produce and easy to get wrong.

Default-category products self-assess; Class I / II devices face stricter conformity routes. References: European Commission — CRA, CISA SBOM resources.