Le CRA, exigence par exigence

Ce que demande le CRA

Early warning within 24 hours of becoming aware, notification within 72 hours and a final report within 14 days after a corrective measure is available, via the ENISA single reporting platform.

Paraphrase en anglais, pas le texte légal ; relecture juridique en attente.

Comment ProveStack aide

• DisponibleReport preparation from a human determination, with early-warning, notification and final-report deadlines, and receipts recorded after a person submits.
• DisponibleA finding flagged exploited in the wild prompts a possible reporting assessment; a person decides, and nothing is reported automatically.
• DisponibleVulnerability handling policy template: questionnaire, deterministic draft, editing, independent approval, then linked as evidence to this obligation. Template wording pending legal review.

Ce que demande le CRA

Early warning within 24 hours, notification within 72 hours and a final report within one month of the notification.

Paraphrase en anglais, pas le texte légal ; relecture juridique en attente.

Comment ProveStack aide

• DisponibleReport preparation from a human determination, with early-warning, notification and final-report deadlines, and receipts recorded after a person submits.
• DisponibleVulnerability handling policy template: questionnaire, deterministic draft, editing, independent approval, then linked as evidence to this obligation. Template wording pending legal review.

Ce que demande le CRA

Inform impacted users about an actively exploited vulnerability or severe incident and, where needed, about mitigations they can apply.

Paraphrase en anglais, pas le texte légal ; relecture juridique en attente.

Comment ProveStack aide

• DisponibleReport preparation from a human determination, with early-warning, notification and final-report deadlines, and receipts recorded after a person submits.

Ce que demande le CRA

Design, develop and produce the product according to the essential cybersecurity requirements, based on a documented cybersecurity risk assessment that is kept up to date.

Paraphrase en anglais, pas le texte légal ; relecture juridique en attente.

Comment ProveStack aide

• DisponibleObligation tracking with recorded applicability decisions and independently reviewed evidence.
• En développementGuided cybersecurity risk-assessment template.

Ce que demande le CRA

Exercise due diligence when integrating third-party components, including open-source software, so they do not compromise the product's cybersecurity.

Paraphrase en anglais, pas le texte légal ; relecture juridique en attente.

Comment ProveStack aide

• DisponibleSBOM import and explainable advisory matching for every third-party component.
• DisponibleOn-demand SBOM import per release from GitHub: the SBOM attached to the GitHub release (exact), otherwise the repository dependency graph, marked partial when the default branch is not the tagged commit. The access token is used for that one import and never stored.
• En développementAutomatic import when a release is published on GitHub.

Ce que demande le CRA

Identify and document vulnerabilities and components, including a software bill of materials in a commonly used, machine-readable format covering at least top-level dependencies.

Paraphrase en anglais, pas le texte légal ; relecture juridique en attente.

Comment ProveStack aide

• DisponibleCycloneDX JSON SBOM import per release, with source hash and import history, including failed imports.
• DisponibleOn-demand SBOM import per release from GitHub: the SBOM attached to the GitHub release (exact), otherwise the repository dependency graph, marked partial when the default branch is not the tagged commit. The access token is used for that one import and never stored.
• DisponibleVulnerability handling policy template: questionnaire, deterministic draft, editing, independent approval, then linked as evidence to this obligation. Template wording pending legal review.
• En développementAutomatic import when a release is published on GitHub.

Ce que demande le CRA

Address and remediate vulnerabilities without delay, including through security updates, and test and review the product's security regularly.

Paraphrase en anglais, pas le texte légal ; relecture juridique en attente.

Comment ProveStack aide

• DisponibleTriage with separate severity, exposure and exploitation; retest evidence, independent review, and reassessment when an advisory or component changes.
• DisponibleExploited-vulnerability feeds (CISA KEV and the ENISA EU Vulnerability Database, unofficial format), uploaded as files or refreshed live when enabled, linked to your advisories by CVE or GHSA id: matching findings are flagged exploited in the wild.
• DisponibleGuided exploitation checks per finding (npm, PyPI, generic, container images): read-only commands you copy and run yourself, never run by ProveStack, with outcomes recorded as evidence for review.
• DisponibleVulnerability handling policy template: questionnaire, deterministic draft, editing, independent approval, then linked as evidence to this obligation. Template wording pending legal review.

Ce que demande le CRA

Put in place and enforce a coordinated vulnerability disclosure policy and a contact address for reporting vulnerabilities.

Paraphrase en anglais, pas le texte légal ; relecture juridique en attente.

Comment ProveStack aide

• DisponibleCoordinated vulnerability disclosure policy and security contact templates, with an RFC 9116 security.txt file: questionnaire, deterministic draft, editing, independent approval, then linked as evidence. Template wording pending legal review.

Ce que demande le CRA

Provide security updates securely, free of charge where required, with advisory information for users, and publicly disclose fixed vulnerabilities.

Paraphrase en anglais, pas le texte légal ; relecture juridique en attente.

Comment ProveStack aide

• DisponibleRecord and review evidence of how a security update reached users.
• DisponibleVulnerability handling policy template: questionnaire, deterministic draft, editing, independent approval, then linked as evidence to this obligation. Template wording pending legal review.
• PrévuSecurity advisory publication helper.

Ce que demande le CRA

Determine a support period reflecting the expected use time (generally at least five years unless the product is expected to be used for less) and handle vulnerabilities throughout it.

Paraphrase en anglais, pas le texte légal ; relecture juridique en attente.

Comment ProveStack aide

• DisponibleReleases with a support end date, so the support period you publish has a source.
• DisponibleSupport period statement template drafted from your releases' support end dates, approved by a second person and linked as evidence. Template wording pending legal review.

Ce que demande le CRA

Draw up technical documentation before placing the product on the market and keep it up to date.

Paraphrase en anglais, pas le texte légal ; relecture juridique en attente.

Comment ProveStack aide

• DisponibleEvidence packet export: frozen product state, provenance, journal and unresolved items, identified by a SHA-256 manifest.
• PrévuTechnical documentation assembly.

Ce que demande le CRA

Provide users with the required information and instructions, including the support period end and the contact point for vulnerability reporting.

Paraphrase en anglais, pas le texte légal ; relecture juridique en attente.

Comment ProveStack aide

• DisponibleSecurity contact (with security.txt) and support period statement templates, for the contact and support information users need. Template wording pending legal review.
• PrévuUser information and instructions template.

Ce que demande le CRA

Carry out the applicable conformity assessment procedure for the product's category, draw up the EU declaration of conformity and affix the CE marking. ProveStack does not perform or grant this.

Paraphrase en anglais, pas le texte légal ; relecture juridique en attente.

Comment ProveStack aide

• DisponibleReadiness tracking and reviewed evidence to prepare your conformity assessment.

Tracking only: ProveStack does not perform conformity assessment or grant CE marking.

Ce que demande le CRA

Place on the market only products whose manufacturer has carried out the conformity assessment, drawn up technical documentation and affixed the CE marking.

Paraphrase en anglais, pas le texte légal ; relecture juridique en attente.

Comment ProveStack aide

• DisponibleRole-based applicability decisions and evidence of the checks made before placing the product on the market.

Ce que demande le CRA

Act with due care, verifying the CE marking and that manufacturer and importer obligations were met before making the product available.

Paraphrase en anglais, pas le texte légal ; relecture juridique en attente.

Comment ProveStack aide

• DisponibleRole-based applicability decisions and evidence of your due-care checks.

Ce que demande le CRA

Put in place and document a cybersecurity policy fostering secure development and effective vulnerability handling, and cooperate with market surveillance authorities.

Paraphrase en anglais, pas le texte légal ; relecture juridique en attente.

Comment ProveStack aide

• DisponibleRole-based applicability decisions and evidence for your documented cybersecurity policy.