Dev.to Security 🔐 Cybersecurity 👁 0 📖 3 min read

BSI TR-03185 & CRA: How to Ship Security Patches Without Triggering Software Re-Certification

Shipping rapid security updates, CVE hotfixes, and cryptographic library upgrades (such as OpenSSL 3.5 or wolfSSL PQC patches) in regulated software used to trigger a painful dilemma: Wait months for external re-certific

Shipping rapid security updates, CVE hotfixes, and cryptographic library upgrades (such as OpenSSL 3.5 or wolfSSL PQC patches) in regulated software used to trigger a painful dilemma: Wait months for external re-certification, or ship immediately and risk compliance violations.

With BSI Technical Guideline TR-03185 (Secure Software Lifecycle), BSI TR-03161 (Healthcare / DiGA Applications), and the EU Cyber Resilience Act (CRA) reporting mandates that took effect in September 2026, the German Federal Office for Information Security (BSI) defined a clear engineering framework: Manufacturers can ship security patches without losing existing certifications — provided their release process follows a documented, risk-classified SDLC with automated SBOM evidence.

🛡️ 1. The 3-Tier Update Classification Matrix (BSI TR-03185)

To avoid full re-certification on every maintenance release, engineering and Regulatory Affairs teams must classify every change before merge/release:

Update Class Definition & Scope Re-Certification Required? Required CI/CD Audit Evidence
Class A: Security & Crypto Patch Dependency upgrades, CVE patches, cipher/TLS hardening without altering security architecture or external APIs. No (Self-attestation per BSI TR-03185-2) Automated SAST/SCA pass + CycloneDX SBOM (BSI TR-03183-2) + VEX status + Release Sign-Off Protocol
Class B: Minor Architectural / Feature Change Adjustments to internal modules, non-critical UI/workflow changes, or updated sub-components. Partial / Delta Review Threat Model delta (STRIDE) + Regression test log + Updated SBOM
Class C: Major Functional / Security Boundary Change New authentication flows, altered encryption architecture, new external attack surfaces, or core data-model changes. Yes (Full audit / BfArM notification) Complete security assessment + Penetration test + Full certification dossier

👉 Read the full German & EU technical deep-dive: BSI TR-03185: Software-Updates ohne Rezertifizierung & CRA-Compliance 2026

⚙️ 2. Automating BSI TR-03183-2 SBOM & Crypto Gates in GitHub Actions

Under BSI TR-03183-2 and the Cyber Resilience Act (CRA), every release artifact must be accompanied by a machine-readable Software Bill of Materials (SBOM) in CycloneDX or SPDX format, alongside cryptographic configuration verification:

name: BSI TR-03185 Release Gate & SBOM Evidence

on:
  release:
    types: [published]

jobs:
  tr03185-compliance-gate:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Source
        uses: actions/checkout@v4

      - name: Generate CycloneDX SBOM (BSI TR-03183-2)
        run: |
          pipx run cyclonedx-py environment -o sbom-cyclonedx.json

      - name: Verify Host & Container Crypto Policy (BSI TR-02102-1)
        run: |
          curl -sSL https://raw.githubusercontent.com/KenanErorr404/bsi-tr02102-pqc-audit-cli/main/bsi_pqc_check.py | python3 - --json-out cbom-evidence.json

      - name: Archive Release Evidence Bundle
        uses: actions/upload-artifact@v4
        with:
          name: bsi-tr03185-release-evidence
          path: |
            sbom-cyclonedx.json
            cbom-evidence.json

📥 3. Download the Free €0+ Audit Matrix Sample & Full .xlsx Toolkit

To save engineering leads, Product Security Officers (PSOs), and MedTech/DiGA teams weeks of manual documentation:

  • 🆓 Download the Free €0+ BSI TR-02102 & TR-03185 Audit Sample & Quickstart Matrix (flcsb) Contains BSI-Audit-Matrix-Leseprobe.csv + README-Upgrade-auf-Enterprise-XLSX.md with a 20% discount code (BSI2026PRO) for the full enterprise suites.
  • 🛡️ Get the Full BSI TR-03185 & DiGA TR-03161 Audit-Readiness-Pack (€49) Includes 5 turnkey enterprise assets:
    1. BSI-TR-03185-und-DiGA-TR03161-Audit-Workbook.xlsx (3-tab Excel workbook with Executive Readiness Scoring Dashboard, Class A/B/C Patch Classification Matrix, and BfArM DiGA TR-03161 & TR-03183 SBOM Mapping)
    2. TR-03185-Prozess-Audit-Matrix.csv (Machine-readable QMS/ISMS import)
    3. SOP-Sicherer-Release-Prozess-TR03185.md (Full Standard Operating Procedure for engineering teams)
    4. Checkliste-Update-Ohne-Rezertifizierung.html (Printable & digitally fillable release sign-off protocol for BfArM/BSI auditors)
    5. ci-cd/tr03185-release-gate.yml (Production GitHub Actions workflow for CycloneDX SBOM & evidence bundling)

🔗 Related Open-Source Tools & Guides

📰 Read the original article on Dev.to Security

Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.

Share 𝕏 Twitter ✈ Telegram ↗ Reddit 🟧 HN
← News 🔐 Cybersecurity 🏠 Home