Plan your CRA support window
Set your product's expected lifetime and see the support period the CRA obliges you to cover.
Under the CRA you must handle vulnerabilities for your product's expected lifetime — and for at least five years unless it's genuinely in use for less. Set the lifetime and see the obligation.
Support · 8 yr
Ship5-yr floor15 yr
Expected lifetime8 years
CRA minimum5 years
Support obligation8 years
For 8 years you owe monitoring, vulnerability handling, and free security updates — planned and budgeted, not improvised at year four.
a taste of Proofwright
It's live.
See the real thing at Proofwright.