Products

Last checked on 29-09-2026

Products shows the software, apps and devices your organisation delivers to customers, with their kind, current version, who is responsible, until when you support them and their status.

Why this protects your organisation

What you place on the market has requirements of its own. A customer wants to know until when you provide security updates for a product, and who is responsible when a vulnerability turns up in it. Legislation such as the Cyber Resilience Act sets requirements per product, not per organisation. A list of your products is the start: later the requirements, evidence and agreements per product hang off it.

Steps

Open Products in the Organisation group.
Click Create product.
Fill in the Name and choose the Kind: software, app, device with software, or component or library.
Fill in the Current version, choose who is Responsible from People and fill in Supported until: until when you provide security updates.
Choose the Status and click Create.
Open the product and click Import SBOM under Components to take over the libraries and parts from an SBOM (CycloneDX or SPDX, JSON). You can also add a component by hand.
When a vulnerability becomes known, click Create vulnerability under Vulnerabilities on the product's screen, choose the severity and the affected components, and update the assessment, the measure and the dates of fixing and publishing as you go.
When you no longer place a product on the market, set its Status to Withdrawn.

The list shows per product the Name with its description, the Kind, the Current version, who is Responsible, Supported until, the Standards adopted for it and the Status. You can filter on Kind and Status.

Components

On a product's own screen, Components lists the libraries and parts it is made of, with version, supplier, licence, package URL and source. Import SBOM takes them over from an SBOM in CycloneDX or SPDX format. Importing the same SBOM again adds nothing twice. A component a new SBOM no longer lists stays visible with the date it left the product, so you can later tell what it contained at a given moment. When a new vulnerability becomes known, you then know at once whether a product may be affected.

Vulnerabilities

Under Vulnerabilities you record per product which vulnerabilities you know of: the identifier (such as a CVE number), where you learned of it, the severity, the affected components, your assessment and measure, and when you fixed it and informed your users. If your product turns out not to be affected, set the status to Not affected and write in the assessment why. You only choose components of the same product. If a vulnerability is actively exploited, switch that on: the duty to report of the Cyber Resilience Act then applies, with an early warning to the CSIRT within 24 hours.

Reports

If a vulnerability in a product is actively exploited, or a severe incident affects its security, the duty to report of the Cyber Resilience Act applies. An actively exploited vulnerability shows Start report; under Reports you also start a report on a severe incident. You fill in when your organisation knew: every deadline runs from that moment. The early warning is due within 24 hours, the notification within 72 hours, and the final report no later than 14 days after the fix is available for a vulnerability, and within a month after the notification for a severe incident. Trustbird does not report to the CSIRT itself: with Record step you record per step when you reported and what. You record informing your users the same way. The table shows per step when it is due or when it was sent. Times are in Dutch time.

The next step of an open report stands on Today for everyone in the workspace. When a deadline draws near, the owners of the workspace and the person responsible for the product get an email: 6 hours before the early warning, 24 hours before the notification and 3 days before the final report. Each step gets one reminder. A deadline that has already passed sends no email, but the step shows on Today as overdue.

A product is something you deliver, not an asset. What you use yourself, such as your servers and laptops, is under Assets.

If it does not work

I do not see Create product

You need edit rights for the Organisation module. Owners and members have them; an advisor only when the workspace owner grants them.

I cannot delete a product

A product with a standard adopted for it is kept, because the assessments and evidence belong to it. Set its Status to Withdrawn instead.

I cannot edit or delete a component from the SBOM

A component from an SBOM follows the SBOM. Import a new SBOM: what it no longer lists stays visible as no longer in the product. Only a component you added by hand is edited or deleted here.

The Responsible list is empty

You choose the responsible person from People. Add them there first.

Screens this is about

Products