From 77bf0376b9affa1659ecbe745aec9a452af4e42f Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Wed, 3 Jun 2026 12:09:22 -0700 Subject: [PATCH 001/100] soi:sample: Add section Conceptual Overview Signed-off-by: Gregory Shue --- conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc index 9ea11bedb..16d46d483 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc @@ -32,6 +32,11 @@ It is expected to be composed of the following subsystems: <<< +[[SECTION]] +TITLE: Conceptual Overview + +[[/SECTION]] + [DOCUMENT_FROM_FILE] FILE: ../system_requirements/sdoc/index.sdoc From e55a8692ccb2effe2ffeb907332d940e7edb3961 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Wed, 3 Jun 2026 12:13:08 -0700 Subject: [PATCH 002/100] soi:sample:overview: Add summary stmt Signed-off-by: Gregory Shue --- .../content/src/SOI/SAMPLE/sdoc/index.sdoc | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc index 16d46d483..508600153 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc @@ -8,7 +8,7 @@ SPDX-License-Identifier: Apache-2.0 [TEXT] STATEMENT: >>> -The System-of-Interest named SAMPLE is the top-level system in this example. +The System-of-Interest named SAMPLE is the top-level system in this example. It is expected to be composed of the following subsystems: @@ -35,6 +35,18 @@ It is expected to be composed of the following subsystems: [[SECTION]] TITLE: Conceptual Overview +[TEXT] +STATEMENT: >>> +SAMPLE is a Product Line of commodity consumer electronics devices intended for +markets requiring conformance with the EU Cyber Resilience Act. The range of +devices supported by this Product Line is expected to expand over time as +more product types become commoditized. + +SAMPLE is expected to be **reused and extended** by +interested Open-Source Software Projects and Component Manufacturers for +developing assets conformant with the EU CRA. +<<< + [[/SECTION]] [DOCUMENT_FROM_FILE] From cd57e5d8e35bb318bca216fe9d97c7cb261e6581 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Wed, 3 Jun 2026 12:15:28 -0700 Subject: [PATCH 003/100] soi:sample:overview: Add section PL Problem Domain Signed-off-by: Gregory Shue --- conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc index 508600153..0d7757419 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc @@ -47,6 +47,11 @@ interested Open-Source Software Projects and Component Manufacturers for developing assets conformant with the EU CRA. <<< +[[SECTION]] +TITLE: Product Line Problem Domain + +[[/SECTION]] + [[/SECTION]] [DOCUMENT_FROM_FILE] From ec925f14b158173be8b2813aed11093991efe9f0 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Wed, 3 Jun 2026 12:17:25 -0700 Subject: [PATCH 004/100] soi:sample:overview: Add PL Problem Domain stmt Signed-off-by: Gregory Shue --- .../content/src/SOI/SAMPLE/sdoc/index.sdoc | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc index 0d7757419..8f9a66f29 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc @@ -50,6 +50,20 @@ developing assets conformant with the EU CRA. [[SECTION]] TITLE: Product Line Problem Domain +[TEXT] +STATEMENT: >>> +SAMPLE is intended to support at least +commodity consumer electronics devices. These products may end +up being used in commercial and/or civil deployments. +These products are NOT expected to be used in industrial or +safety-critical deployments. + +To support growth of the Product Line Solution Domain (solution space) +with minimal impact on existing assets, the Product Line Problem Domain +will be the context for evaluating and understanding all System Engineering +artifacts for SAMPLE. +<<< + [[/SECTION]] [[/SECTION]] From 40c5aaaacf013e2bf9446002d06327b07b5ef1fe Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Wed, 3 Jun 2026 12:19:03 -0700 Subject: [PATCH 005/100] soi:sample:overview: Add section PL Solution Domain (Scope) Signed-off-by: Gregory Shue --- conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc index 8f9a66f29..b31ed525c 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc @@ -66,6 +66,11 @@ artifacts for SAMPLE. [[/SECTION]] +[[SECTION]] +TITLE: Product Line Solution Domain (Scope) + +[[/SECTION]] + [[/SECTION]] [DOCUMENT_FROM_FILE] From c5806c30126c517d173ab3ea1713f169e65c1fdc Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Wed, 3 Jun 2026 12:25:42 -0700 Subject: [PATCH 006/100] soi:sample:overview: Add diagram Generic Product Solution Framework Signed-off-by: Gregory Shue --- .../content/src/SOI/SAMPLE/sdoc/index.sdoc | 53 +++++++++++-------- 1 file changed, 32 insertions(+), 21 deletions(-) diff --git a/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc index b31ed525c..6c4d2f830 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc @@ -9,27 +9,6 @@ SPDX-License-Identifier: Apache-2.0 [TEXT] STATEMENT: >>> The System-of-Interest named SAMPLE is the top-level system in this example. - -It is expected to be composed of the following subsystems: - -.. raw:: html - - 
-    ---
-    title: Topology of Systems-of-Interest
-    ---
-    stateDiagram-v2
-
-        state SAMPLE {
-            TBD_Security_Vulnerability_Reporting: TBD 
 Security 
 Vulnerability 
 Reporting 
 Server
-            TBD_Desktop_SW: TBD 
 Desktop SW
-            TBD_Mobile_SW: TBD 
 Mobile SW
-            TBD_Devices: TBD 
 Device(s)
-            TBD_Cloud_SW: TBD 
 Cloud SW
-            TBD_Digital_Component_Update_Server: TBD 
 Digital 
 Component 
 Update 
 Server
-        }
-
-
<<< [[SECTION]] @@ -69,6 +48,38 @@ artifacts for SAMPLE. [[SECTION]] TITLE: Product Line Solution Domain (Scope) +[TEXT] +STATEMENT: >>> +SAMPLE is designed upon the following generic solution framework for products: + +.. raw:: html + + 
+    ---
+    title: Generic Product Solution Framework
+    ---
+    stateDiagram-v2
+	state "Cloud-based Services" as MfgCloudSvcs {
+	    direction LR
+	    state "Product Support" as PrdSupport {
+		direction LR
+		state "Documentation 
(per Product)" as PrdDocs
+	    }
+	}
+
+	state "Applications" as MgrApps {
+	    direction LR
+	    state "Desktop Applications" as MfgDesktopApps
+	    state "Mobile Apps" as MfgMobileApps
+	}
+
+	state "Devices" as Devices {
+	    direction LR
+            state "Manufacturer Parts" as MfgParts
+        }
+
+<<< + [[/SECTION]] [[/SECTION]] From a1070ae9a1fde6b0cac8e449fdcad1ba03daaea2 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Wed, 3 Jun 2026 12:32:01 -0700 Subject: [PATCH 007/100] soi:sample:overview:soln: Add section Feature List Signed-off-by: Gregory Shue --- conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc index 6c4d2f830..f63d0274d 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc @@ -80,6 +80,11 @@ SAMPLE is designed upon the following generic solution framework for products: <<< +[[SECTION]] +TITLE: Feature List + +[[/SECTION]] + [[/SECTION]] [[/SECTION]] From 17934145e4e575ce6e535aa4f21d22b42f6f31d0 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Wed, 3 Jun 2026 12:33:03 -0700 Subject: [PATCH 008/100] soi:sample:overview:soln: Add section Product List Signed-off-by: Gregory Shue --- conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc index f63d0274d..bf17ee540 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc @@ -85,6 +85,11 @@ TITLE: Feature List [[/SECTION]] +[[SECTION]] +TITLE: Product List + +[[/SECTION]] + [[/SECTION]] [[/SECTION]] From d5702204598341a045c005a1d6086c80d841738e Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Wed, 3 Jun 2026 12:37:37 -0700 Subject: [PATCH 009/100] soi:sample:overview:soln:features: Prelim Feature List Signed-off-by: Gregory Shue --- .../content/src/SOI/SAMPLE/sdoc/index.sdoc | 58 +++++++++++++++++++ 1 file changed, 58 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc index bf17ee540..c70b5af79 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc @@ -83,6 +83,64 @@ SAMPLE is designed upon the following generic solution framework for products: [[SECTION]] TITLE: Feature List +[TEXT] +STATEMENT: >>> +As a Product Lines evolves the sponsors of the Product Line may require it +to support a larger solution domain than previously chosen. A best practice +for Product Line Engineering is to evaluate architectures and designs for +reusability in reasonably foreseeable scope growth. + +The following Feature List outlines the breadth of product categories +and functionalities to be considered when describing and evaluating +SAMPLE requirements and designs. + +.. note:: + Bold text indicates **invariant feature/value** across Product Line scope. + + Italic text indicates *anticipated expansion* of Product Line scope. + +- User Interface + + - Label(s) + - Device Status LED(s) + - Button(s) + - *Network Activity Indication(s)* + - *User Authentication via Finger Print* + +- Communication Interfaces + + - USB Device + + - Physical Connector + + - *USB A Male* + - USB C Male connector + + - Network Interface + + - 100BASE-TX + - *10BASE-T1L* + - *802.15.4* + - *BlueTooth* + - *WIFI* + +- Functionality + + - Secure Boot + - Firmware Update + + - On-demand FW Update (pushed to Device) + - *Automated FW Update (pulled by Device)* + - *FW Update schedule control
(periods of blocked vs listening vs requesting)* + + - Network Interface + - *Network Sniffer* + - *Network Router* + - *Network Gateway* + - *Network-Attached Storage (NAS)* + - *BlueTooth Beacon* +<<< + [[/SECTION]] [[SECTION]] From 1088fff0412fda0221cb16a38ae48fb602aac93d Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Wed, 3 Jun 2026 12:47:26 -0700 Subject: [PATCH 010/100] soi:sample:overview:soln:products: SAMPLE Product 1 Signed-off-by: Gregory Shue --- .../example1/content/src/SOI/SAMPLE/sdoc/index.sdoc | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc index c70b5af79..53c6e4d8b 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc @@ -146,6 +146,13 @@ SAMPLE requirements and designs. [[SECTION]] TITLE: Product List +[TEXT] +STATEMENT: >>> +The following are nominal descriptions of the products in SAMPLE: + +- SAMPLE Product 1: a USB-C to 100Base-T Network Interface Dongle +<<< + [[/SECTION]] [[/SECTION]] From 4a01830ef3fd54e8654f391ee089bb82ef1cffe7 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Wed, 3 Jun 2026 13:19:53 -0700 Subject: [PATCH 011/100] soi:sample:sysreq: Add SEBoK example types of requirements Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 36 +++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 5957b5c26..08b63e662 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -22,3 +22,39 @@ From `SEBoK Wiki Glossary - system requirement >> +From `SEBoK Wiki System Requirements Definition - Cateorizing Requirements `_ Table 1: Example Types of Requirement Categories. (Derived from the INCOSE Needs and Requirements Manual): + + **Function/Performance**: + The primary functions and associated performance that the SoI needs to perform in terms of its intended use. + The functions address the capabilities and features the stakeholders expect the SoI to have; + performance addresses how well, how many, how fast attributes of the function. + Many of the primary functions involve interactions (interfaces) between the SOI and systems external to the SOI. + All critical and high priority needs would be included in this category. + + **Fit/Operational**: + Requirements dealing with functions that deal with a secondary or enabling capabilities, functions, and interactions + between the SoI and external systems needed for the system to accomplish its primary functions. + This includes functions concerning the ability of the system to interface with, interact with, + connect to, operate within, and become an integral part of the macro system it is a part. + Fit includes human system interactions and interfaces as well as both the induced and natural environments + (conditions of operations, transportation, storage, maintenance). + For example, needs associated with safety, security, power, cooling, transportation and handling, + storage, maintenance, and disposal. + + **Form**: + Physical Characteristics. + The shape, size, dimensions, mass, weight, and other observable parameters and characterizes that uniquely distinguish a system. + For software, form could address programming language, lines of code, memory requirements. + + **Quality**: + Fitness for use. + For example, various “-ilities” such as reliability, testability, operability, availability, + maintainability, operability, supportability, manufacturability, and interoperability. + + **Compliance**: + Conformance with design and construction standards and regulations. +<<< From 26ea5673497d90335bfb73a07f4367296edca077 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Thu, 4 Jun 2026 19:34:18 -0700 Subject: [PATCH 012/100] soi:sample:sysreq: Add section Products Signed-off-by: Gregory Shue --- .../src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 08b63e662..4cb6b6fb7 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -58,3 +58,9 @@ From `SEBoK Wiki System Requirements Definition - Cateorizing Requirements Date: Wed, 3 Jun 2026 13:26:21 -0700 Subject: [PATCH 013/100] soi:sample:sysreq: Add section Form Requirements Signed-off-by: Gregory Shue --- .../src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 4cb6b6fb7..5a5579ee5 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -62,5 +62,10 @@ From `SEBoK Wiki System Requirements Definition - Cateorizing Requirements Date: Wed, 3 Jun 2026 13:24:04 -0700 Subject: [PATCH 014/100] soi:sample:sysreq: Add section Functional/Performance Requirements Signed-off-by: Gregory Shue --- .../src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 5a5579ee5..9e6ffcf3b 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -69,3 +69,9 @@ MID: 5ea16839694b4826b65b6c37b699520e TITLE: Form Requirements [[/SECTION]] + +[[SECTION]] +MID: 884cf538ab2045eabbe5c3eec0c5c5d8 +TITLE: Function/Performance Requirements + +[[/SECTION]] From 221d7a37d812bfaa854dd5be1462b45f7dc9fd9e Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Wed, 3 Jun 2026 13:25:23 -0700 Subject: [PATCH 015/100] soi:sample:sysreq: Add section Fit/Operational Requirements Signed-off-by: Gregory Shue --- .../src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 9e6ffcf3b..4e8b0f138 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -75,3 +75,9 @@ MID: 884cf538ab2045eabbe5c3eec0c5c5d8 TITLE: Function/Performance Requirements [[/SECTION]] + +[[SECTION]] +MID: 37e5c597ed264cb2947fa545ce55f16a +TITLE: Fit/Operational Requirements + +[[/SECTION]] From 366466189070d9f7c62ae4c264de9d6b76b493af Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Wed, 3 Jun 2026 13:27:12 -0700 Subject: [PATCH 016/100] soi:sample:sysreq: Add section Quality Requirements Signed-off-by: Gregory Shue --- .../src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 4e8b0f138..0cc46928d 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -81,3 +81,9 @@ MID: 37e5c597ed264cb2947fa545ce55f16a TITLE: Fit/Operational Requirements [[/SECTION]] + +[[SECTION]] +MID: b5da670d3a834dc49f81d30405f64186 +TITLE: Quality Requirements + +[[/SECTION]] From ce5dd8876819537d4452d692815896c4b810e1dd Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Wed, 3 Jun 2026 13:28:20 -0700 Subject: [PATCH 017/100] soi:sample:sysreq: Add section Compliance Requirements Signed-off-by: Gregory Shue --- .../src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 0cc46928d..5313af066 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -87,3 +87,9 @@ MID: b5da670d3a834dc49f81d30405f64186 TITLE: Quality Requirements [[/SECTION]] + +[[SECTION]] +MID: 5e8fe852c4ab4bbcb65babb69cd54f54 +TITLE: Compliance Requirements + +[[/SECTION]] From 1ba45aa675db233c0cdbefaef86a46c8d56e4d42 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Thu, 4 Jun 2026 09:04:44 -0700 Subject: [PATCH 018/100] soi:sample:sysreq:compl: Add section EU CRA Signed-off-by: Gregory Shue --- .../src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 5313af066..a4dc0b9af 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -92,4 +92,10 @@ TITLE: Quality Requirements MID: 5e8fe852c4ab4bbcb65babb69cd54f54 TITLE: Compliance Requirements +[[SECTION]] +MID: da48546cc8f042048ad11f86516be826 +TITLE: EU Cyber Resilience Act (CRA) + +[[/SECTION]] + [[/SECTION]] From d50b7202b37822de39ddfacdbfbc15339a4f0ae5 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Thu, 4 Jun 2026 09:10:57 -0700 Subject: [PATCH 019/100] soi:sample:sysreq:compl:cra: SAMPLE conform with EU CRA Signed-off-by: Gregory Shue --- .../SAMPLE/system_requirements/sdoc/index.sdoc | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index a4dc0b9af..5d18f8c1d 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -96,6 +96,23 @@ TITLE: Compliance Requirements MID: da48546cc8f042048ad11f86516be826 TITLE: EU Cyber Resilience Act (CRA) +[REQUIREMENT] +MID: ed23e2e6e8254eb59c4508f69f84e226 +UID: SYSREQ-1 +STATUS: Draft +VERIFICATION: Review +TITLE: SAMPLE conforms with EU CRA +STATEMENT: >>> +SAMPLE shall be in conformance with the EU Cyber Resilience Act. +<<< +RATIONALE: >>> +Initial SAMPLE products must be marketable in the EU. This impacts the entire product development process, therefore the entire SAMPLE should be developed conformant +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKNEED-1 + ROLE: Refines + [[/SECTION]] [[/SECTION]] From dea4015ed2ed7eb5a95a357162fedd5843dfef7e Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 10:59:53 -0700 Subject: [PATCH 020/100] soi:sample:sysreq:compl: add section EU CRA Annex I Signed-off-by: Gregory Shue --- .../src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 5d18f8c1d..d79d0e768 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -113,6 +113,12 @@ RELATIONS: VALUE: STKNEED-1 ROLE: Refines +[[SECTION]] +MID: 19712c509b5742e6a2d50049b13ac395 +TITLE: EU CRA Annex I - Essential Cybersecurity Requirements + +[[/SECTION]] + [[/SECTION]] [[/SECTION]] From 1e55562acf9a578dc9411940a70ec923be5230d8 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 11:00:45 -0700 Subject: [PATCH 021/100] soi:sample:sysreq:compl: add section EU CRA Annex II Signed-off-by: Gregory Shue --- .../src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index d79d0e768..bbd49c91d 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -119,6 +119,12 @@ TITLE: EU CRA Annex I - Essential Cybersecurity Requirements [[/SECTION]] +[[SECTION]] +MID: 8cfb56fdeb62410997700ba4f36c71d6 +TITLE: EU CRA Annex II - Information and Instructions to the User + +[[/SECTION]] + [[/SECTION]] [[/SECTION]] From 68c7e59c056a89724af9984ad64f57c54335ba33 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 11:01:39 -0700 Subject: [PATCH 022/100] soi:sample:sysreq:compl: add section EU CRA Annex VII Signed-off-by: Gregory Shue --- .../src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index bbd49c91d..c03a3b76e 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -125,6 +125,12 @@ TITLE: EU CRA Annex II - Information and Instructions to the User [[/SECTION]] +[[SECTION]] +MID: 45bfb6ee6be540b29d7670cb85b26485 +TITLE: EU CRA Annex VII - Content of the Technical Documentation + +[[/SECTION]] + [[/SECTION]] [[/SECTION]] From e7de528e9c14a77f362748d73efd26c775e298aa Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 11:03:31 -0700 Subject: [PATCH 023/100] soi:sample:sysreq:compl:eu_cra:annexI: add section Part I Signed-off-by: Gregory Shue --- .../src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index c03a3b76e..9c8584b3e 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -117,6 +117,12 @@ RELATIONS: MID: 19712c509b5742e6a2d50049b13ac395 TITLE: EU CRA Annex I - Essential Cybersecurity Requirements +[[SECTION]] +MID: 0db4652dc8eb4d36bdf25f87b69b2a4a +TITLE: Part I Cybersecurity requirements relating to the properties of products with digital elements + +[[/SECTION]] + [[/SECTION]] [[SECTION]] From 8cc8823773f3d2d59967a24326ee85e2a7212a97 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 11:04:17 -0700 Subject: [PATCH 024/100] soi:sample:sysreq:compl:eu_cra:annexI: add section Part II Signed-off-by: Gregory Shue --- .../src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 9c8584b3e..0da216869 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -123,6 +123,12 @@ TITLE: Part I Cybersecurity requirements relating to the properties of products [[/SECTION]] +[[SECTION]] +MID: da470fd368d640f7b4662ae9a53fff57 +TITLE: Part II Vulnerability handling requirements + +[[/SECTION]] + [[/SECTION]] [[SECTION]] From b45c63a12f15dae40f7c339df35af868a2846b71 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 11:09:41 -0700 Subject: [PATCH 025/100] soi:sample:sysreq:compl:eu_cra:annexI:ptI: add sysreq for EU CRA Annex I Part I (1) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 0da216869..7aa74d659 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -121,6 +121,25 @@ TITLE: EU CRA Annex I - Essential Cybersecurity Requirements MID: 0db4652dc8eb4d36bdf25f87b69b2a4a TITLE: Part I Cybersecurity requirements relating to the properties of products with digital elements +[REQUIREMENT] +MID: 024fc370f3e84eceb0d9c7d0f13b0bdd +UID: SYSREQ-8 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex I Part I (1) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +SAMPLE shall design, develop, and produce said product in such a way that it ensures an appropriate level of cybersecurity based on risks. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-2 + ROLE: Refines + [[/SECTION]] [[SECTION]] From fa8e36306863b2e91be8d356e953bd5754653faf Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 11:15:50 -0700 Subject: [PATCH 026/100] soi:sample:sysreq:compl:eu_cra:annexI:ptI: add sysreq for EU CRA Annex I Part I (2a) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 7aa74d659..03fec72b6 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -140,6 +140,27 @@ RELATIONS: VALUE: STKREQ-2 ROLE: Refines +[REQUIREMENT] +MID: f407f450f5d84a9e808fbfe43f6db343 +UID: SYSREQ-9 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex I Part I (2a) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +On the basis of the cybersecurity risk assessment referred to in EU CRA Article 13(2) and where applicable, + +SAMPLE shall make available said product without known exploitable vulnerabilities. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-3 + ROLE: Refines + [[/SECTION]] [[SECTION]] From ae4b4f62ee7cd1cb201785110b57fc4da1fc0046 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 11:18:47 -0700 Subject: [PATCH 027/100] soi:sample:sysreq:compl:eu_cra:annexI:ptI: add sysreq for EU CRA Annex I Part I (2b) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 03fec72b6..870916b51 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -161,6 +161,27 @@ RELATIONS: VALUE: STKREQ-3 ROLE: Refines +[REQUIREMENT] +MID: 04c4521915eb4d359f5d21bf60905897 +UID: SYSREQ-10 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex I Part I (2b) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +On the basis of the cybersecurity risk assessment referred to in EU CRA Article 13(2) and where applicable, + +SAMPLE shall make available said product with a secure by default configuration, unless otherwise agreed between manufacturer and business user in relation to a tailor-made product with digital elements, including the possibility to reset the product to its original state. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-4 + ROLE: Refines + [[/SECTION]] [[SECTION]] From a18dbda205319aaa26939b7095227d2f9ca361ab Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 11:22:31 -0700 Subject: [PATCH 028/100] soi:sample:sysreq:compl:eu_cra:annexI:ptI: add sysreq for EU CRA Annex I Part I (2c) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 870916b51..58d0de49a 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -182,6 +182,27 @@ RELATIONS: VALUE: STKREQ-4 ROLE: Refines +[REQUIREMENT] +MID: 9379059ed06047f28580bbda86deedd0 +UID: SYSREQ-11 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex I Part I (2c) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where applicable, + +SAMPLE shall ensure that vulnerabilities of said product can be addressed through security updates, including, where applicable, through automatic security updates that are installed within an appropriate timeframe enabled as a default setting, with a clear and easy-to-use opt-out mechanism, through the notification of available updates to users, and the option to temporarily postpone them. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-5 + ROLE: Refines + [[/SECTION]] [[SECTION]] From 9b8ecaaafbe378abbfb4062827859190d98912fa Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 11:26:54 -0700 Subject: [PATCH 029/100] soi:sample:sysreq:compl:eu_cra:annexI:ptI: add sysreq for EU CRA Annex I Part I (2d) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 58d0de49a..272ce163b 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -203,6 +203,27 @@ RELATIONS: VALUE: STKREQ-5 ROLE: Refines +[REQUIREMENT] +MID: eee702f0779845a5a730947fce3749ad +UID: SYSREQ-12 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex I Part I (2d) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +On the basis of the cybersecurity risk assessment referred to in EU CRA Article 13(2) and where applicable, + +SAMPLE shall ensure protection from unauthorised access of said product by appropriate control mechanisms, including but not limited to authentication, identity or access management systems, and report on possible unauthorised access. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-6 + ROLE: Refines + [[/SECTION]] [[SECTION]] From 803d5d75b43fa65a2e73b85399121da76a74ce4e Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 11:30:35 -0700 Subject: [PATCH 030/100] soi:sample:sysreq:compl:eu_cra:annexI:ptI: add sysreq for EU CRA Annex I Part I (2e) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 272ce163b..392a9ba10 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -224,6 +224,27 @@ RELATIONS: VALUE: STKREQ-6 ROLE: Refines +[REQUIREMENT] +MID: 10f815a21a574f8cb725c45ca35ee4f2 +UID: SYSREQ-13 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex I Part I (2e) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +On the basis of the cybersecurity risk assessment referred to in EU CRA Article 13(2) and where applicable, + +SAMPLE shall protect the confidentiality of stored, transmitted or otherwise processed data by said product, personal or other, such as by encrypting relevant data at rest or in transit by state of the art mechanisms, and by using other technical means. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-7 + ROLE: Refines + [[/SECTION]] [[SECTION]] From cf73326bcaa0fba51cd918b12d68c77a2f76af11 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 11:33:57 -0700 Subject: [PATCH 031/100] soi:sample:sysreq:compl:eu_cra:annexI:ptI: add sysreq for EU CRA Annex I Part I (2f) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 392a9ba10..30f069c51 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -245,6 +245,27 @@ RELATIONS: VALUE: STKREQ-7 ROLE: Refines +[REQUIREMENT] +MID: 5649a5815d9c4c669261dd92c0147e0e +UID: SYSREQ-14 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex I Part I (2f) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +On the basis of the cybersecurity risk assessment referred to in EU CRA Article 13(2) and where applicable, + +SAMPLE shall protect the integrity of stored, transmitted or otherwise processed data, personal or other, commands, programs and configuration by said product against any manipulation or modification not authorised by the user, and report on corruptions. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-8 + ROLE: Refines + [[/SECTION]] [[SECTION]] From 20513b4ca79d63ffb2ec548d85207ae46b26121b Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 11:36:42 -0700 Subject: [PATCH 032/100] soi:sample:sysreq:compl:eu_cra:annexI:ptI: add sysreq for EU CRA Annex I Part I (2g) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 30f069c51..02e96662e 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -266,6 +266,27 @@ RELATIONS: VALUE: STKREQ-8 ROLE: Refines +[REQUIREMENT] +MID: 1b59f57be743413fbbdeb402cb159bc2 +UID: SYSREQ-15 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex I Part I (2g) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where applicable, + +SAMPLE shall process by said product only data, personal or other, that are adequate, relevant and limited to what is necessary in relation to the intended purpose of said product (data minimisation). +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-9 + ROLE: Refines + [[/SECTION]] [[SECTION]] From 5c6482a8f2b110b71223dcba6d5d5f728600865c Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 11:39:36 -0700 Subject: [PATCH 033/100] soi:sample:sysreq:compl:eu_cra:annexI:ptI: add sysreq for EU CRA Annex I Part I (2h) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 02e96662e..2fc76cbbf 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -287,6 +287,27 @@ RELATIONS: VALUE: STKREQ-9 ROLE: Refines +[REQUIREMENT] +MID: 5dd4362d6ba6490083daf804c48c224b +UID: SYSREQ-16 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex I Part I (2h) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where applicable, + +SAMPLE shall protect the availability of essential and basic functions of said product, also after an incident, including through resilience and mitigation measures against denial-of-service attacks. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-10 + ROLE: Refines + [[/SECTION]] [[SECTION]] From 38c8e325b0d9f131184a0c5d95c7b6afaa553ef3 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 11:42:40 -0700 Subject: [PATCH 034/100] soi:sample:sysreq:compl:eu_cra:annexI:ptI: add sysreq for EU CRA Annex I Part I (2i) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 2fc76cbbf..9bec62320 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -308,6 +308,27 @@ RELATIONS: VALUE: STKREQ-10 ROLE: Refines +[REQUIREMENT] +MID: 3f0f4ca5a0064b90a41a6fc46af2b631 +UID: SYSREQ-17 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex I Part I (2i) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where applicable, + +SAMPLE shall minimise the negative impact by said product itself or connected devices on the availability of services provided by other devices or networks. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-11 + ROLE: Refines + [[/SECTION]] [[SECTION]] From 6d79a48fd27c9f6e9b32d883fdc0c7ef8ef5f1dc Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 11:48:43 -0700 Subject: [PATCH 035/100] soi:sample:sysreq:compl:eu_cra:annexI:ptI: add sysreq for EU CRA Annex I Part I (2j) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 9bec62320..5827a7e4a 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -329,6 +329,27 @@ RELATIONS: VALUE: STKREQ-11 ROLE: Refines +[REQUIREMENT] +MID: e40eca3d4be64c37b4765437b8bb0fff +UID: SYSREQ-18 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex I Part I (2j) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +On the basis of the cybersecurity risk assessment referred to in EU CRA Article 13(2) and where applicable, + +SAMPLE shall expose said product that is designed, developed and produced to limit attack surfaces, including external interfaces. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-12 + ROLE: Refines + [[/SECTION]] [[SECTION]] From 696abc4af310c2bf8840019256ba89a5b24d5b56 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 11:51:04 -0700 Subject: [PATCH 036/100] soi:sample:sysreq:compl:eu_cra:annexI:ptI: add sysreq for EU CRA Annex I Part I (2k) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 5827a7e4a..2b83c08c2 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -350,6 +350,27 @@ RELATIONS: VALUE: STKREQ-12 ROLE: Refines +[REQUIREMENT] +MID: 8e9ed7e1ef904e1a9daad9e6b9641337 +UID: SYSREQ-19 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex I Part I (2k) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +On the basis of the cybersecurity risk assessment referred to in EU CRA Article 13(2) and where applicable, + +SAMPLE shall expose said product that is designed, developed and produced to reduce the impact of an incident using appropriate exploitation mitigation mechanisms and techniques. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-13 + ROLE: Refines + [[/SECTION]] [[SECTION]] From 950f9b7c5c4261ddc01a0a859b253ee3e55cfc9d Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 11:53:22 -0700 Subject: [PATCH 037/100] soi:sample:sysreq:compl:eu_cra:annexI:ptI: add sysreq for EU CRA Annex I Part I (2l) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 2b83c08c2..68291a003 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -371,6 +371,27 @@ RELATIONS: VALUE: STKREQ-13 ROLE: Refines +[REQUIREMENT] +MID: 6eb65000f7534df99c2fa65a1062b10f +UID: SYSREQ-20 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex I Part I (2l) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +On the basis of the cybersecurity risk assessment referred to in EU CRA Article 13(2) and where applicable, + +SAMPLE shall expose said product that provides security related information by recording and monitoring relevant internal activity, including the access to or modification of data, services or functions, with an opt-out mechanism for the user. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-14 + ROLE: Refines + [[/SECTION]] [[SECTION]] From 89f236255bd430bd54824235ff1712af75a11e8c Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 11:55:44 -0700 Subject: [PATCH 038/100] soi:sample:sysreq:compl:eu_cra:annexI:ptI: add sysreq for EU CRA Annex I Part I (2m) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 68291a003..4bf510a81 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -392,6 +392,27 @@ RELATIONS: VALUE: STKREQ-14 ROLE: Refines +[REQUIREMENT] +MID: f3a69e5ee598469f95b60b76f586cb88 +UID: SYSREQ-21 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex I Part I (2m) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +On the basis of the cybersecurity risk assessment referred to in EU CRA Article 13(2) and where applicable, + +SAMPLE shall expose said product that provides the possibility for users to securely and easily remove on a permanent basis all data and settings and, where such data can be transferred to other products or systems, ensure that this is done in a secure manner. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-15 + ROLE: Refines + [[/SECTION]] [[SECTION]] From fdf6704c87643890b340ca4f14d33ba8a2607faf Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 12:28:38 -0700 Subject: [PATCH 039/100] soi:sample:sysreq:compl:eu_cra:annexI:ptII: add sysreq for EU CRA Annex I Part II (1) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 4bf510a81..cb52a5a0e 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -419,6 +419,25 @@ RELATIONS: MID: da470fd368d640f7b4662ae9a53fff57 TITLE: Part II Vulnerability handling requirements +[REQUIREMENT] +MID: 344696ab9db54f3a9b55be2d98e69c5c +UID: SYSREQ-22 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex I Part II (1) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +SAMPLE shall identify and document vulnerabilities and components contained in said product, including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies of the product. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-16 + ROLE: Refines + [[/SECTION]] [[/SECTION]] From 56ee161490a0ab81e02eba182a83f2e36c4bf061 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 12:31:18 -0700 Subject: [PATCH 040/100] soi:sample:sysreq:compl:eu_cra:annexI:ptII: add sysreq for EU CRA Annex I Part II (2)(a) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index cb52a5a0e..20dbe3da7 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -438,6 +438,25 @@ RELATIONS: VALUE: STKREQ-16 ROLE: Refines +[REQUIREMENT] +MID: 7f52c152c7684e919af1c775ebd9129c +UID: SYSREQ-23 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex I Part II (2)(a) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +SAMPLE shall in relation to the risks posed to said product, address and remediate vulnerabilities without delay, including by providing security updates. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-17 + ROLE: Refines + [[/SECTION]] [[/SECTION]] From 1f8c230f09ac42b4611d2e2afa41b5351f00c141 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 12:33:46 -0700 Subject: [PATCH 041/100] soi:sample:sysreq:compl:eu_cra:annexI:ptII: add sysreq for EU CRA Annex I Part II (2)(b) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 20dbe3da7..c060a5c30 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -457,6 +457,27 @@ RELATIONS: VALUE: STKREQ-17 ROLE: Refines +[REQUIREMENT] +MID: a369011ad4814a3bbcc44644a1b07b89 +UID: SYSREQ-24 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex I Part II (2)(b) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +Where technically feasible, + +SAMPLE shall provide for said product new security updates separately from functionality updates. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-18 + ROLE: Refines + [[/SECTION]] [[/SECTION]] From 33d74b9169c0170ec90abccb7168d043d61fc3c9 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 12:36:53 -0700 Subject: [PATCH 042/100] soi:sample:sysreq:compl:eu_cra:annexI:ptII: add sysreq for EU CRA Annex I Part II (3) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index c060a5c30..0dca0a288 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -478,6 +478,25 @@ RELATIONS: VALUE: STKREQ-18 ROLE: Refines +[REQUIREMENT] +MID: e8827c5c99574cf5a00e332f9f647ae2 +UID: SYSREQ-25 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex I Part II (3) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +SAMPLE shall apply effective and regular tests and reviews of the security of said product. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-19 + ROLE: Refines + [[/SECTION]] [[/SECTION]] From f0655e2fefc9d5752cc852401d55adba3c51f6f8 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 12:41:36 -0700 Subject: [PATCH 043/100] soi:sample:sysreq:compl:eu_cra:annexI:ptII: add sysreq for EU CRA Annex I Part II (4)(a) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 0dca0a288..52bafd0af 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -497,6 +497,27 @@ RELATIONS: VALUE: STKREQ-19 ROLE: Refines +[REQUIREMENT] +MID: bb3ea745c70b4a34b857f37a1d541d6f +UID: SYSREQ-26 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex I Part II (4)(a) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +Once a security update has been made available for said product, + +SAMPLE shall share and publicly disclose information about fixed vulnerabilities, including a description of the vulnerabilities, information allowing users to identify the product with digital elements affected, the impacts of the vulnerabilities, their severity and clear and accessible information helping users to remediate the vulnerabilities. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-20 + ROLE: Refines + [[/SECTION]] [[/SECTION]] From 7effb9368e8dc33896bddabaaae8fae3f8db5a25 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 12:51:14 -0700 Subject: [PATCH 044/100] soi:sample:sysreq:compl:eu_cra:annexI:ptII: add sysreq for EU CRA Annex I Part II (4)(b) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 52bafd0af..cf63562c0 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -518,6 +518,27 @@ RELATIONS: VALUE: STKREQ-20 ROLE: Refines +[REQUIREMENT] +MID: f19fc90733b9461da8f867664f0f1bf9 +UID: SYSREQ-27 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex I Part II (4)(b) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +Where Manufacturers of said product consider the security risks of publication to outweigh the security benefits, + +SAMPLE shall duly justify for this case any delay in making public information regarding a fixed vulnerability until after users have been given the possibility to apply the relevant patch. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-21 + ROLE: Refines + [[/SECTION]] [[/SECTION]] From 3d9ac8e39c33c9d3fc39d680e4273d33d79f284a Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 12:53:28 -0700 Subject: [PATCH 045/100] soi:sample:sysreq:compl:eu_cra:annexI:ptII: add sysreq for EU CRA Annex I Part II (5) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index cf63562c0..d19f726d9 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -539,6 +539,25 @@ RELATIONS: VALUE: STKREQ-21 ROLE: Refines +[REQUIREMENT] +MID: aa777f856bd047b8b03c81a8565ad280 +UID: SYSREQ-28 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex I Part II (5) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +SAMPLE shall have fin place and enforce a policy on coordinated vulnerability disclosure. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-22 + ROLE: Refines + [[/SECTION]] [[/SECTION]] From e9ab5352723b1898b9dea01fa1c390675b341fda Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 12:55:52 -0700 Subject: [PATCH 046/100] soi:sample:sysreq:compl:eu_cra:annexI:ptII: add sysreq for EU CRA Annex I Part II (6) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index d19f726d9..a3e45d758 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -558,6 +558,25 @@ RELATIONS: VALUE: STKREQ-22 ROLE: Refines +[REQUIREMENT] +MID: 5b289af5050745a59b3d757cdb6bec99 +UID: SYSREQ-29 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex I Part II (6) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +SAMPLE shall take measures to facilitate the sharing of information about potential vulnerabilities in said product as well as in third-party components contained in said product, including by providing a contact address for the reporting of the vulnerabilities discovered in the product with digital elements. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-23 + ROLE: Refines + [[/SECTION]] [[/SECTION]] From ac45c4fc77e889dad1b35af2fdd5afd97576ccf2 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 12:57:51 -0700 Subject: [PATCH 047/100] soi:sample:sysreq:compl:eu_cra:annexI:ptII: add sysreq for EU CRA Annex I Part II (7) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index a3e45d758..9e5bee71e 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -577,6 +577,25 @@ RELATIONS: VALUE: STKREQ-23 ROLE: Refines +[REQUIREMENT] +MID: be65a0346dea4d1ba68c4aafc2dc9e41 +UID: SYSREQ-30 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex I Part II (7) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +SAMPLE shall provide for mechanisms to securely distribute updates for said product to ensure that vulnerabilities are fixed or mitigated in a timely manner and, where applicable for security updates, in an automatic manner. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-24 + ROLE: Refines + [[/SECTION]] [[/SECTION]] From 0f6519fbac4df245f04f54e18d64314d5de07d4d Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 12:59:36 -0700 Subject: [PATCH 048/100] soi:sample:sysreq:compl:eu_cra:annexI:ptII: add sysreq for EU CRA Annex I Part II (8) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 9e5bee71e..1c29d6d0f 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -596,6 +596,25 @@ RELATIONS: VALUE: STKREQ-24 ROLE: Refines +[REQUIREMENT] +MID: 2b6535d0e51d4933bcc5e3fad64ee0bd +UID: SYSREQ-31 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex I Part II (8) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +SAMPLE shall ensure that, where security updates are available to address identified security issues, they are disseminated without delay and, unless otherwise agreed between a manufacturer and a business user in relation to a tailor-made product with digital elements, free of charge, accompanied by advisory messages providing users with the relevant information, including on potential action to be taken. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-25 + ROLE: Refines + [[/SECTION]] [[/SECTION]] From f608d5a5de6cd85b4c7775435b5fb656c8c15243 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 13:05:44 -0700 Subject: [PATCH 049/100] soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex II (1)(a) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 21 ++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 1c29d6d0f..88e554731 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -462,7 +462,7 @@ MID: a369011ad4814a3bbcc44644a1b07b89 UID: SYSREQ-24 STATUS: Draft VERIFICATION: Test -TITLE: SAMPLE complies with EU CRA Annex I Part II (2)(b) +TITLE: 6.1.2.2.2. SAMPLE complies with EU CRA Annex I Part II (2)(b) STATEMENT: >>> Where a SAMPLE product with digital elements is exposed to the EU marketplace, @@ -623,6 +623,25 @@ RELATIONS: MID: 8cfb56fdeb62410997700ba4f36c71d6 TITLE: EU CRA Annex II - Information and Instructions to the User +[REQUIREMENT] +MID: 3e894e64a9454a7ea214e5a0cca561eb +UID: SYSREQ-32 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex II (1)(a) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +SAMPLE shall expose said product accompanied by the name, registered trade name or registered trademark of the manufacturer. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-26 + ROLE: Refines + [[/SECTION]] [[SECTION]] From af439446eb16cfa20240f79482a029794bb99f04 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 13:07:59 -0700 Subject: [PATCH 050/100] soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex II (1)(b) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 88e554731..117d57919 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -642,6 +642,25 @@ RELATIONS: VALUE: STKREQ-26 ROLE: Refines +[REQUIREMENT] +MID: eb617e9542dc4484bca920736c61c07c +UID: SYSREQ-33 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex II (1)(b) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +SAMPLE shall expose said product accompanied by the postal address at which the manufacturer can be contacted. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-27 + ROLE: Refines + [[/SECTION]] [[SECTION]] From c8d5440a0fbd0906a9ccd926991e4986e7563d20 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 13:10:07 -0700 Subject: [PATCH 051/100] soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex II (1)(c) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 117d57919..64c29f76f 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -661,6 +661,25 @@ RELATIONS: VALUE: STKREQ-27 ROLE: Refines +[REQUIREMENT] +MID: fbc0c2c06d10461c8ca78aeb67c4cae8 +UID: SYSREQ-34 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex II (1)(c) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +SAMPLE shall expose said product accompanied by the email address or other digital contact at which the manufacturer can be contacted. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-28 + ROLE: Refines + [[/SECTION]] [[SECTION]] From a4a4174d8760893d767eac52cfb8a2aba09e7127 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 13:12:11 -0700 Subject: [PATCH 052/100] soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex II (1)(d) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 64c29f76f..e5b8cf57c 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -680,6 +680,25 @@ RELATIONS: VALUE: STKREQ-28 ROLE: Refines +[REQUIREMENT] +MID: 3497d0df96f34d22b01931a62464ebef +UID: SYSREQ-35 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex II (1)(d) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +SAMPLE shall expose said product accompanied by, where available, the website at which the manufacturer can be contacted. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-29 + ROLE: Refines + [[/SECTION]] [[SECTION]] From 48b947229d30f179b8941e34074a92ad3eb41656 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 15:04:43 -0700 Subject: [PATCH 053/100] soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex II (2)(a) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index e5b8cf57c..0a90b302c 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -699,6 +699,25 @@ RELATIONS: VALUE: STKREQ-29 ROLE: Refines +[REQUIREMENT] +MID: 7479d55bd90e4305952dae351280a624 +UID: SYSREQ-36 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex II (2)(a) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +SAMPLE shall expose said product accompanied by the single point of contact where information about vulnerabilities of the product with digital elements can be reported and received. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-30 + ROLE: Refines + [[/SECTION]] [[SECTION]] From c69c550df7aef1b9cebc948d931102caee6009e3 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 15:07:02 -0700 Subject: [PATCH 054/100] soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex II (2)(b) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 0a90b302c..5e429be07 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -718,6 +718,25 @@ RELATIONS: VALUE: STKREQ-30 ROLE: Refines +[REQUIREMENT] +MID: 44eb9f55e3434c79808df49068ec696a +UID: SYSREQ-37 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex II (2)(b) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +SAMPLE shall expose said product accompanied by where the manufacturer’s policy on coordinated vulnerability disclosure can be found. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-31 + ROLE: Refines + [[/SECTION]] [[SECTION]] From d3883869392c755a6ecd52c973e160e2da544a03 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 15:09:31 -0700 Subject: [PATCH 055/100] soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex II (3) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 5e429be07..d4c42ee8c 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -737,6 +737,25 @@ RELATIONS: VALUE: STKREQ-31 ROLE: Refines +[REQUIREMENT] +MID: 68d4f0bf7c5549b29e16a74a30c52cd8 +UID: SYSREQ-38 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex II (3) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +SAMPLE shall expose said product accompanied by name and type and any additional information enabling the unique identification of said product. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-32 + ROLE: Refines + [[/SECTION]] [[SECTION]] From 3642e35d8326aa46fcc87358581de6bd78fed150 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 15:14:12 -0700 Subject: [PATCH 056/100] soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex II (4) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 23 +++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index d4c42ee8c..dec2b63fe 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -756,6 +756,29 @@ RELATIONS: VALUE: STKREQ-32 ROLE: Refines +[REQUIREMENT] +MID: f11f4fe45e554ab3826efd3f6703b413 +UID: SYSREQ-39 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex II (4) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +SAMPLE shall expose said product accompanied by the intended purpose of said product, including: + +- the security environment provided by the manufacturer, +- the product’s essential functionalities, +- information about the security properties. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-33 + ROLE: Refines + [[/SECTION]] [[SECTION]] From 4b1a97e0935554936453e39e20e434417a21b818 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 15:16:28 -0700 Subject: [PATCH 057/100] soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex II (5)(a) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index dec2b63fe..9d11e15a1 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -779,6 +779,25 @@ RELATIONS: VALUE: STKREQ-33 ROLE: Refines +[REQUIREMENT] +MID: d7e6c7e539f3446cbccb5f820f6a05d8 +UID: SYSREQ-40 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex II (5)(a) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +SAMPLE shall expose said product accompanied by any known or foreseeable circumstance, related to the use of the product with digital elements in accordance with its intended purpose, which may lead to significant cybersecurity risks. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-34 + ROLE: Refines + [[/SECTION]] [[SECTION]] From 5310966a90b84d80ba921e2e2ceb806f2f1c76b4 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 15:18:24 -0700 Subject: [PATCH 058/100] soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex II (5)(b) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 9d11e15a1..93d9c33cb 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -798,6 +798,25 @@ RELATIONS: VALUE: STKREQ-34 ROLE: Refines +[REQUIREMENT] +MID: e4d63b545df94751a2be659166bfb3e9 +UID: SYSREQ-41 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex II (5)(b) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +SAMPLE shall expose said product accompanied by any known or foreseeable circumstance, related to the use of the product with digital elements under conditions of reasonably foreseeable misuse, which may lead to significant cybersecurity risks. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-35 + ROLE: Refines + [[/SECTION]] [[SECTION]] From c0259f871472ae59b9947ca599961e7e25fb6b56 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 15:20:46 -0700 Subject: [PATCH 059/100] soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex II (6) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 93d9c33cb..90288b1b0 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -817,6 +817,25 @@ RELATIONS: VALUE: STKREQ-35 ROLE: Refines +[REQUIREMENT] +MID: f70db83f8e3c420a9b497b43abece708 +UID: SYSREQ-42 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex II (6) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +SAMPLE shall expose said product accompanied by where applicable, the internet address at which the EU declaration of conformity can be accessed. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-36 + ROLE: Refines + [[/SECTION]] [[SECTION]] From 4c29ca6fda726177a061971aab9b468f68d02224 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 15:22:57 -0700 Subject: [PATCH 060/100] soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex II (7)(a) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 90288b1b0..1562e4fa1 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -836,6 +836,25 @@ RELATIONS: VALUE: STKREQ-36 ROLE: Refines +[REQUIREMENT] +MID: fed4f268465b4412a682d05595e8b0f3 +UID: SYSREQ-43 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex II (7)(a) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +SAMPLE shall expose said product accompanied by the type of technical security support offered by the manufacturer. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-37 + ROLE: Refines + [[/SECTION]] [[SECTION]] From c650cb756b56bb287c2d1d1ee4c871ef5944250d Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 15:25:30 -0700 Subject: [PATCH 061/100] soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex II (7)(b) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 1562e4fa1..e667b23e5 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -855,6 +855,28 @@ RELATIONS: VALUE: STKREQ-37 ROLE: Refines +[REQUIREMENT] +MID: ef718eade30140e7801c992c9ba5e5da +UID: SYSREQ-44 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex II (7)(b) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +SAMPLE shall expose said product accompanied by the end-date of the support period during which users can expect: + +- vulnerabilities to be handled, +- to receive security updates. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-38 + ROLE: Refines + [[/SECTION]] [[SECTION]] From 800e5d3269ed19c3efc129d3c6ef5f5c1a7ddede Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 15:27:51 -0700 Subject: [PATCH 062/100] soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex II (8)(a) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index e667b23e5..9b5624122 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -877,6 +877,25 @@ RELATIONS: VALUE: STKREQ-38 ROLE: Refines +[REQUIREMENT] +MID: a3880db5c00b4cd28fd01ebb1a6b0b12 +UID: SYSREQ-45 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex II (8)(a) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +SAMPLE shall expose said product accompanied by detailed instructions or an internet address referring to such detailed instructions and information on the necessary measures during initial commissioning and throughout the lifetime of the product with digital elements to ensure its secure use. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-39 + ROLE: Refines + [[/SECTION]] [[SECTION]] From 0c82500e3afe67197a9865ce94a21393a13f1e43 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 15:31:15 -0700 Subject: [PATCH 063/100] soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex II (8)(b) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 9b5624122..832dac22c 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -896,6 +896,25 @@ RELATIONS: VALUE: STKREQ-39 ROLE: Refines +[REQUIREMENT] +MID: fd553831781342c2ad9307acee5b4595 +UID: SYSREQ-46 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex II (8)(b) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +SAMPLE shall expose said product accompanied by detailed instructions or an internet address referring to such detailed instructions and information on how changes to said product can affect the security of data. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-40 + ROLE: Refines + [[/SECTION]] [[SECTION]] From 36ad558d2baedacc3509bc0a8bc35349c47cb55b Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 15:33:27 -0700 Subject: [PATCH 064/100] soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex II (8)(c) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 832dac22c..dde3c8cfe 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -915,6 +915,25 @@ RELATIONS: VALUE: STKREQ-40 ROLE: Refines +[REQUIREMENT] +MID: 7d15d96c1cc04b48a3a29fcdd8f59f87 +UID: SYSREQ-47 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex II (8)(c) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +SAMPLE shall expose said product accompanied by detailed instructions or an internet address referring to such detailed instructions and information on how security-relevant updates can be installed for said product. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-41 + ROLE: Refines + [[/SECTION]] [[SECTION]] From 97e816c28c05fef54361055423156080d2a0ac4b Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 15:35:48 -0700 Subject: [PATCH 065/100] soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex II (8)(d) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index dde3c8cfe..ede8fbb3c 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -934,6 +934,25 @@ RELATIONS: VALUE: STKREQ-41 ROLE: Refines +[REQUIREMENT] +MID: 65a9f7d7945145d28c1c6a73b1399f3c +UID: SYSREQ-48 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex II (8)(d) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +SAMPLE shall expose said product accompanied by detailed instructions or an internet address referring to such detailed instructions and information on the secure decommissioning of said product, including information on how user data can be securely removed. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-42 + ROLE: Refines + [[/SECTION]] [[SECTION]] From e442a1a7862a5d2b7248bd78432aa83267209114 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 15:38:14 -0700 Subject: [PATCH 066/100] soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex II (8)(e) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index ede8fbb3c..46e5cc588 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -953,6 +953,25 @@ RELATIONS: VALUE: STKREQ-42 ROLE: Refines +[REQUIREMENT] +MID: f9e627c6734941b5bf2f0c05e26dfdfa +UID: SYSREQ-49 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex II (8)(e) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +SAMPLE shall expose said product accompanied by detailed instructions or an internet address referring to such detailed instructions and information on how the default setting enabling the automatic installation of security updates can be turned off. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-43 + ROLE: Refines + [[/SECTION]] [[SECTION]] From 2b71cf67a2ccc26f416fa55e5fc47b75964b65e8 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 15:40:40 -0700 Subject: [PATCH 067/100] soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex II (8)(f) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 24 +++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 46e5cc588..2c286b6b7 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -972,6 +972,30 @@ RELATIONS: VALUE: STKREQ-43 ROLE: Refines +[REQUIREMENT] +MID: ac13e5e0bea242728e96379c4229b50f +UID: SYSREQ-50 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex II (8)(f) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +Where said product is intended for integration into other products with digital elements, + +SAMPLE shall expose said product accompanied by detailed instructions or an internet address referring to such detailed instructions and information on the information necessary for the integrator to comply with: + +- the essential cybersecurity requirements set out in Annex I, +- the documentation requirements set out in Annex VII. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-44 + ROLE: Refines + [[/SECTION]] [[SECTION]] From 1cec0d20ccddff118957e84c2604ed7b022d5b35 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 15:43:08 -0700 Subject: [PATCH 068/100] soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex II (9) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 2c286b6b7..8c31f4f59 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -996,6 +996,27 @@ RELATIONS: VALUE: STKREQ-44 ROLE: Refines +[REQUIREMENT] +MID: 72d69823809a412eb98a15aba88ef601 +UID: SYSREQ-51 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex II (9) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +Where the manufacturer of the product with digital elements decides to make available the software bill of materials to the user, + +SAMPLE shall expose said product accompanied by information on where the software bill of materials can be accessed. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-45 + ROLE: Refines + [[/SECTION]] [[SECTION]] From 30e863ae386ddf0f8359d659c76ba0799d5d7d44 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 16:02:41 -0700 Subject: [PATCH 069/100] soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex VII (1) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 29 +++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 8c31f4f59..d3cd6c4c9 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -1023,6 +1023,35 @@ RELATIONS: MID: 45bfb6ee6be540b29d7670cb85b26485 TITLE: EU CRA Annex VII - Content of the Technical Documentation +[REQUIREMENT] +MID: 21a7a8d02f7c44c09bb4b4ffe892c632 +UID: SYSREQ-52 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex VII (1) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +Where the technical documentation referred to in EU CRA Article 31 shall be provided for said product, + +SAMPLE shall expose said product accompanied by technical documentation containing a general description of said product, including: + +- the intended purpose of said product; +- versions of software affecting compliance with essential cybersecurity requirements; +- where the product with digital elements is a hardware product + + - photographs or illustrations showing external features, marking and internal layout; + +- user information and instructions as set out in EU CRA Annex II. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-46 + ROLE: Refines + [[/SECTION]] [[/SECTION]] From f196c717f10de42d8274bbd56f974221b6d2fa79 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 16:09:16 -0700 Subject: [PATCH 070/100] soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex VII (2) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 35 +++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index d3cd6c4c9..db4e214ff 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -1052,6 +1052,41 @@ RELATIONS: VALUE: STKREQ-46 ROLE: Refines +[REQUIREMENT] +MID: 8faf538ede0547ba8204f50d1a77d73b +UID: SYSREQ-53 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex VII (2) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +Where the technical documentation referred to in EU CRA Article 31 shall be provided for said product, + +SAMPLE shall expose said product accompanied by technical documentation containing a description of the design, development and production of the product with digital elements and vulnerability handling processes, including: + +- necessary information on the design and development of said product, including, where applicable, + + - drawings and schemes and + - a description of the system architecture explaining how software components build on or feed into each other and integrate into the overall processing; + +- necessary information and specifications of the vulnerability handling processes put in place by the manufacturer, including + + - the software bill of materials, + - the coordinated vulnerability disclosure policy, + - evidence of the provision of a contact address for the reporting of the vulnerabilities and + - a description of the technical solutions chosen for the secure distribution of updates; + +- necessary information and specifications of the production and monitoring processes of said product and the validation of those processes; +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-47 + ROLE: Refines + [[/SECTION]] [[/SECTION]] From 7529cc7b97abefb9418b6ae18c644e9667589a5f Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 16:12:43 -0700 Subject: [PATCH 071/100] soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex VII (3) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index db4e214ff..e8c081d3a 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -1087,6 +1087,27 @@ RELATIONS: VALUE: STKREQ-47 ROLE: Refines +[REQUIREMENT] +MID: 0d4e78a61fc942308d26e609d86eedcd +UID: SYSREQ-54 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex VII (3) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +Where the technical documentation referred to in EU CRA Article 31 shall be provided for said product, + +SAMPLE shall expose said product accompanied by technical documentation containing an assessment of the cybersecurity risks against which the product with digital elements is designed, developed, produced, delivered and maintained pursuant to EU CRA Article 13, including how the essential cybersecurity requirements set out in Part I of Annex I are applicable; +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-48 + ROLE: Refines + [[/SECTION]] [[/SECTION]] From 7f26944aa685719e8fbbf1ae3eb733fe43c7491b Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 16:15:22 -0700 Subject: [PATCH 072/100] soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex VII (4) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index e8c081d3a..8c237246d 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -1108,6 +1108,27 @@ RELATIONS: VALUE: STKREQ-48 ROLE: Refines +[REQUIREMENT] +MID: c2576dd2ef2544398bdbc8ddde30e764 +UID: SYSREQ-55 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex VII (4) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +Where the technical documentation referred to in EU CRA Article 31 shall be provided for said product, + +SAMPLE shall expose said product accompanied by technical documentation containing relevant information that was taken into account to determine the support period pursuant to EU CRA Article 13(8) of said product. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-49 + ROLE: Refines + [[/SECTION]] [[/SECTION]] From e69197fb297883457e30a67667f2d6394ca9d713 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 16:20:06 -0700 Subject: [PATCH 073/100] soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex VII (5) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 29 +++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 8c237246d..962330a48 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -1129,6 +1129,35 @@ RELATIONS: VALUE: STKREQ-49 ROLE: Refines +[REQUIREMENT] +MID: ba6a29ecea3f4c0484c534d5f90ef19a +UID: SYSREQ-56 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex VII (5) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +Where the technical documentation referred to in EU CRA Article 31 shall be provided for said product, + +SAMPLE shall expose said product accompanied by technical documentation containing: + +- a list of the harmonised standards applied in full or in part the references of which have been published in the Official Journal of the European Union, common specifications as set out in Article 27 of this Regulation or European cybersecurity certification schemes adopted pursuant to Regulation (EU) 2019/881 pursuant to Article 27(8) of this Regulation; + +- where those harmonised standards, common specifications or European cybersecurity certification schemes have not been applied, + + - descriptions of the solutions adopted to meet the essential cybersecurity requirements set out in Parts I and II of Annex I, including a list of other relevant technical specifications applied. + +In the event of partly applied harmonised standards, common specifications or European cybersecurity certification schemes, the technical documentation shall specify the parts which have been applied; +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-50 + ROLE: Refines + [[/SECTION]] [[/SECTION]] From 9c65117260c68abc4cbe779592cf450120640baf Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 16:23:05 -0700 Subject: [PATCH 074/100] soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex VII (6) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 25 +++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 962330a48..eff6eca27 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -1158,6 +1158,31 @@ RELATIONS: VALUE: STKREQ-50 ROLE: Refines +[REQUIREMENT] +MID: a8ef6ed84f9c454b86315fa1e5a2e5d8 +UID: SYSREQ-57 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex VII (6) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +Where the technical documentation referred to in EU CRA Article 31 shall be provided for said product, + +SAMPLE shall expose said product accompanied by technical documentation containing: + +- reports of the tests carried out to verify the conformity of said product, + +- the vulnerability handling processes with the applicable essential cybersecurity requirements as set out in Parts I and II of EU CRA Annex I; +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-51 + ROLE: Refines + [[/SECTION]] [[/SECTION]] From 4c4bfdc6b264c32b99d5659e350059ddb96a0577 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 16:25:16 -0700 Subject: [PATCH 075/100] soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex VII (7) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index eff6eca27..924b00d84 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -1183,6 +1183,27 @@ RELATIONS: VALUE: STKREQ-51 ROLE: Refines +[REQUIREMENT] +MID: ddb5c0e0021d4c69b4501542ea3cdb28 +UID: SYSREQ-58 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex VII (7) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +Where the technical documentation referred to in EU CRA Article 31 shall be provided for said product, + +SAMPLE shall expose said product accompanied by technical documentation containing a copy of the EU declaration of conformity. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-52 + ROLE: Refines + [[/SECTION]] [[/SECTION]] From 913a3370eabb274c4d3a849d6859dbbe6b489b88 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Tue, 9 Jun 2026 16:28:31 -0700 Subject: [PATCH 076/100] soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex VII (8) Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 924b00d84..a1f163b39 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -1204,6 +1204,27 @@ RELATIONS: VALUE: STKREQ-52 ROLE: Refines +[REQUIREMENT] +MID: 85a4138c197c44e1a1d3f0f15969c0af +UID: SYSREQ-59 +STATUS: Draft +VERIFICATION: Test +TITLE: SAMPLE complies with EU CRA Annex VII (8) +STATEMENT: >>> +Where a SAMPLE product with digital elements is exposed to the EU marketplace, + +Where the technical documentation referred to in EU CRA Article 31 shall be provided for said product, + +SAMPLE shall expose said product accompanied by technical documentation containing (where applicable to said product) the software bill of materials, further to a reasoned request from a market surveillance authority provided that it is necessary in order for that authority to be able to check compliance with the essential cybersecurity requirements set out in EU CRA Annex I. +<<< +RATIONALE: >>> +This only is required of products exposed to the EU marketplace. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKREQ-53 + ROLE: Refines + [[/SECTION]] [[/SECTION]] From 7ff42e43fcec99b846382fe02eeff657dd1f26b9 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Thu, 4 Jun 2026 19:36:26 -0700 Subject: [PATCH 077/100] soi:sample:sysreq:prd: Add section Network Interfaces Signed-off-by: Gregory Shue --- .../src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index a1f163b39..b9cf417e4 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -62,6 +62,13 @@ From `SEBoK Wiki System Requirements Definition - Cateorizing Requirements Date: Wed, 3 Jun 2026 13:49:52 -0700 Subject: [PATCH 078/100] soi:sample:sysreq:prd:netIfc: Add section SAMPLE Product 1 Signed-off-by: Gregory Shue --- .../src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index b9cf417e4..1ac56744a 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -67,6 +67,12 @@ TITLE: Products MID: b2c6b3945a7545af9e66c6301fa58d6c TITLE: Network Interfaces +[[SECTION]] +MID: a5631d22043e47a0bb411ffdde05b1f2 +TITLE: SAMPLE Product 1: USB-C 100Base-T Network Interface Dongle + +[[/SECTION]] + [[/SECTION]] [[/SECTION]] From 59c453f477bde83889e1180066933c3cd0b4c559 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Thu, 4 Jun 2026 09:16:34 -0700 Subject: [PATCH 079/100] soi:sample:sysreq:prd:netIfc:prd1: prelim feature list Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 29 +++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 1ac56744a..a210392a5 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -71,6 +71,35 @@ TITLE: Network Interfaces MID: a5631d22043e47a0bb411ffdde05b1f2 TITLE: SAMPLE Product 1: USB-C 100Base-T Network Interface Dongle +[REQUIREMENT] +MID: 60743133bcc54686af56b015adf6983b +UID: SYSREQ-2 +STATUS: Draft +VERIFICATION: Review +TITLE: SAMPLE Product 1: Feature List +STATEMENT: >>> +SAMPLE shall expose a product with the following features: + +- Internal name: SAMPLE Product 1 +- Product Type: USB Network Interface Dongle +- Communication Interfaces: USB-C (male), Ethernet 100Base-T (RJ-45 socket) +- User Interface: + - Status LED(s) + - physical Command Button(s) +- Product label, showing: + - Manufacturer Name (clear text) + - Product Model (clear text) + - Product Serial Number + - Date of Manufacture (clear text) +<<< +RATIONALE: >>> +Approved by Business Sponsor. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKNEED-15 + ROLE: Refines + [[/SECTION]] [[/SECTION]] From 41d03fc8972bca326737c9c322be7d9fe9a44c12 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Thu, 4 Jun 2026 09:19:18 -0700 Subject: [PATCH 080/100] soi:sample:sysreq:prd:netIfc:prd1: prelim market name Signed-off-by: Gregory Shue --- .../SAMPLE/system_requirements/sdoc/index.sdoc | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index a210392a5..c7100dceb 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -100,6 +100,23 @@ RELATIONS: VALUE: STKNEED-15 ROLE: Refines +[REQUIREMENT] +MID: 984dc2d685b04d5396885c34e73bf3f8 +UID: SYSREQ-3 +STATUS: Draft +VERIFICATION: Review +TITLE: SAMPLE Product 1: Market name +STATEMENT: >>> +Where SAMPLE Product 1 is referenced in a public-facing context, +SAMPLE shall use the following values for product identification: + +- Manufacturer: EXAMPLE +- Model: EXAMPLE USB Ethernet Dongle 100-C +<<< +RATIONALE: >>> +Specified by Product Manager. +<<< + [[/SECTION]] [[/SECTION]] From 5f0102ebff4fa7f3d52eea135604973c16c51918 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Thu, 4 Jun 2026 09:23:01 -0700 Subject: [PATCH 081/100] soi:sample:sysreq:prd:netIfc:prd1: Use SAMPLE USB Dongle Dimension Limits Signed-off-by: Gregory Shue --- .../SOI/SAMPLE/system_requirements/sdoc/index.sdoc | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index c7100dceb..6fe75083e 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -100,6 +100,20 @@ RELATIONS: VALUE: STKNEED-15 ROLE: Refines +[REQUIREMENT] +MID: 3d5e2e50cc96431cb23eb23d36a4e9b8 +UID: SYSREQ-4 +STATUS: Draft +VERIFICATION: Review +TITLE: SAMPLE Product 1: Dimensions +STATEMENT: >>> +Where SAMPLE Product 1 is exposed, +SAMPLE shall limit said SAMPLE Product physical bounds to the SAMPLE USB Network Interface Dongle Dimension Limits. +<<< +RATIONALE: >>> +Specified by Product Manager. +<<< + [REQUIREMENT] MID: 984dc2d685b04d5396885c34e73bf3f8 UID: SYSREQ-3 From 2f2d5f61740a6a023a47b659d62cb642aaa2113f Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Thu, 4 Jun 2026 09:31:15 -0700 Subject: [PATCH 082/100] soi:sample:sysreq:prd:netIfc:prd1: Uses SAMPLE Comm Env Limits Signed-off-by: Gregory Shue --- .../SAMPLE/system_requirements/sdoc/index.sdoc | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 6fe75083e..1609e4eae 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -114,6 +114,24 @@ RATIONALE: >>> Specified by Product Manager. <<< +[REQUIREMENT] +MID: 518b336e898843d3b72e4a8afaf72c53 +UID: SYSREQ-5 +STATUS: Draft +VERIFICATION: Review +TITLE: SAMPLE Product 1: Operating Environment +STATEMENT: >>> +Where SAMPLE Product 1 is exposed, +SAMPLE shall operate SAMPLE Product 1 at full functionality within the SAMPLE Commercial Office Environment Limits. +<<< +RATIONALE: >>> +Required by Product Manager. +<<< +RELATIONS: +- TYPE: Parent + VALUE: STKNEED-13 + ROLE: Refines + [REQUIREMENT] MID: 984dc2d685b04d5396885c34e73bf3f8 UID: SYSREQ-3 From 24783e132580c3953ff82db5d88d98ba89a0ecf4 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Thu, 4 Jun 2026 21:10:35 -0700 Subject: [PATCH 083/100] soi:sample:sysreq:form: Add section Network Interfaces Signed-off-by: Gregory Shue --- .../src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 1609e4eae..b71eb017e 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -159,6 +159,12 @@ Specified by Product Manager. MID: 5ea16839694b4826b65b6c37b699520e TITLE: Form Requirements +[[SECTION]] +MID: 59e2bf589e134085bb7631f3515c4fb1 +TITLE: Network Interfaces + +[[/SECTION]] + [[/SECTION]] [[SECTION]] From 7150bc684a3a150f12b8e772730bdacd8fc5ca3c Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Thu, 4 Jun 2026 21:15:10 -0700 Subject: [PATCH 084/100] soi:sample:sysreq:form:netIfc: add section USB Network Interface Dongles Signed-off-by: Gregory Shue --- .../src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index b71eb017e..a491a22f0 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -163,6 +163,12 @@ TITLE: Form Requirements MID: 59e2bf589e134085bb7631f3515c4fb1 TITLE: Network Interfaces +[[SECTION]] +MID: b3f779d7a30441088b4c319c5d731aad +TITLE: USB Network Interface Dongles + +[[/SECTION]] + [[/SECTION]] [[/SECTION]] From 87e951786c2dc085793f091676190fca1043623d Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Thu, 4 Jun 2026 21:28:25 -0700 Subject: [PATCH 085/100] soi:sample:sysreq:form:netIfc:UsbNetIfcDongle: add req USB Network Interface Dongle Dimension Limits Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index a491a22f0..3be3c9fa6 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -167,6 +167,25 @@ TITLE: Network Interfaces MID: b3f779d7a30441088b4c319c5d731aad TITLE: USB Network Interface Dongles +[REQUIREMENT] +MID: 501d870a2f9e438fafcd9d68b8d10a10 +UID: SYSREQ-7 +STATUS: Draft +VERIFICATION: Review +TITLE: SAMPLE USB Network Interface Dongle Dimension Limits +STATEMENT: >>> +Where a SAMPLE Product is specified to meet the SAMPLE USB Network Interface Dongle Dimension Limits, +SAMPLE shall limit said SAMPLE Product dimensions to the following (including all cables stretched to maximum length): + +- length: <= 30 cm. +- width: <= 10 cm. +- height <= 5 cm. +- weight <= 500 g. +<<< +RATIONALE: >>> +This is expected to be large enough to allow SOC Hardware Manufacturers to build this product using one of their SOC evaluation kits. +<<< + [[/SECTION]] [[/SECTION]] From 70140ef73b8fb8251f4b4031b106962820519ba5 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Thu, 4 Jun 2026 21:03:04 -0700 Subject: [PATCH 086/100] soi:sample:sysreq:fitOp: Add req for SAMPLE Commercial Office Env Limits Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 3be3c9fa6..ebdcf7c4a 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -202,6 +202,25 @@ TITLE: Function/Performance Requirements MID: 37e5c597ed264cb2947fa545ce55f16a TITLE: Fit/Operational Requirements +[REQUIREMENT] +MID: a8144501d3724c6cbc69efe6fdd1d6cc +UID: SYSREQ-6 +STATUS: Draft +VERIFICATION: Review +TITLE: SAMPLE Commercial Office Env Limits +STATEMENT: >>> +Where a SAMPLE Product is specified to operate in a SAMPLE Commercial Office Environment, +SAMPLE shall operate said SAMPLE Product at full functionality within the following environment: + +- Minimum Temperature: 0 degrees C (32 degrees F) +- Maximum Temperature: 40 degrees C (104 degrees F) +- Minimum Relative Humidity: 20% +- Maximum Relative Humidity: 95% +<<< +RATIONALE: >>> +Required by Product Manager. +<<< + [[/SECTION]] [[SECTION]] From 4606656613c5814d5aa3f21a48901e26caea1fe0 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Fri, 12 Jun 2026 10:30:13 -0700 Subject: [PATCH 087/100] soi:sample:sysreq:conf:eu_cra clean out `with digital elements` Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 130 +++++++++--------- 1 file changed, 65 insertions(+), 65 deletions(-) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index ebdcf7c4a..6cfe39cda 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -269,7 +269,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex I Part I (1) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, SAMPLE shall design, develop, and produce said product in such a way that it ensures an appropriate level of cybersecurity based on risks. <<< @@ -288,7 +288,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex I Part I (2a) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, On the basis of the cybersecurity risk assessment referred to in EU CRA Article 13(2) and where applicable, @@ -309,11 +309,11 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex I Part I (2b) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, On the basis of the cybersecurity risk assessment referred to in EU CRA Article 13(2) and where applicable, -SAMPLE shall make available said product with a secure by default configuration, unless otherwise agreed between manufacturer and business user in relation to a tailor-made product with digital elements, including the possibility to reset the product to its original state. +SAMPLE shall make available said product with a secure by default configuration, unless otherwise agreed between manufacturer and business user in relation to a tailor-made SAMPLE product, including the possibility to reset the product to its original state. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -330,7 +330,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex I Part I (2c) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where applicable, @@ -351,7 +351,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex I Part I (2d) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, On the basis of the cybersecurity risk assessment referred to in EU CRA Article 13(2) and where applicable, @@ -372,7 +372,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex I Part I (2e) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, On the basis of the cybersecurity risk assessment referred to in EU CRA Article 13(2) and where applicable, @@ -393,7 +393,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex I Part I (2f) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, On the basis of the cybersecurity risk assessment referred to in EU CRA Article 13(2) and where applicable, @@ -414,11 +414,11 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex I Part I (2g) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where applicable, -SAMPLE shall process by said product only data, personal or other, that are adequate, relevant and limited to what is necessary in relation to the intended purpose of said product (data minimisation). +SAMPLE shall process by said product only data, personal or ohttps://zoom.us/j/99157617857ther, that are adequate, relevant and limited to what is necessary in relation to the intended purpose of said product (data minimisation). <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -435,7 +435,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex I Part I (2h) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where applicable, @@ -456,7 +456,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex I Part I (2i) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where applicable, @@ -477,7 +477,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex I Part I (2j) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, On the basis of the cybersecurity risk assessment referred to in EU CRA Article 13(2) and where applicable, @@ -498,7 +498,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex I Part I (2k) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, On the basis of the cybersecurity risk assessment referred to in EU CRA Article 13(2) and where applicable, @@ -519,7 +519,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex I Part I (2l) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, On the basis of the cybersecurity risk assessment referred to in EU CRA Article 13(2) and where applicable, @@ -540,7 +540,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex I Part I (2m) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, On the basis of the cybersecurity risk assessment referred to in EU CRA Article 13(2) and where applicable, @@ -567,7 +567,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex I Part II (1) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, SAMPLE shall identify and document vulnerabilities and components contained in said product, including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies of the product. <<< @@ -586,7 +586,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex I Part II (2)(a) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, SAMPLE shall in relation to the risks posed to said product, address and remediate vulnerabilities without delay, including by providing security updates. <<< @@ -605,7 +605,7 @@ STATUS: Draft VERIFICATION: Test TITLE: 6.1.2.2.2. SAMPLE complies with EU CRA Annex I Part II (2)(b) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, Where technically feasible, @@ -626,7 +626,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex I Part II (3) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, SAMPLE shall apply effective and regular tests and reviews of the security of said product. <<< @@ -645,11 +645,11 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex I Part II (4)(a) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, Once a security update has been made available for said product, -SAMPLE shall share and publicly disclose information about fixed vulnerabilities, including a description of the vulnerabilities, information allowing users to identify the product with digital elements affected, the impacts of the vulnerabilities, their severity and clear and accessible information helping users to remediate the vulnerabilities. +SAMPLE shall share and publicly disclose information about fixed vulnerabilities, including a description of the vulnerabilities, information allowing users to identify the SAMPLE product affected, the impacts of the vulnerabilities, their severity and clear and accessible information helping users to remediate the vulnerabilities. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -666,7 +666,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex I Part II (4)(b) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, Where Manufacturers of said product consider the security risks of publication to outweigh the security benefits, @@ -687,7 +687,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex I Part II (5) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, SAMPLE shall have fin place and enforce a policy on coordinated vulnerability disclosure. <<< @@ -706,9 +706,9 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex I Part II (6) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, -SAMPLE shall take measures to facilitate the sharing of information about potential vulnerabilities in said product as well as in third-party components contained in said product, including by providing a contact address for the reporting of the vulnerabilities discovered in the product with digital elements. +SAMPLE shall take measures to facilitate the sharing of information about potential vulnerabilities in said product as well as in third-party components contained in said product, including by providing a contact address for the reporting of the vulnerabilities discovered in the SAMPLE product. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -725,7 +725,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex I Part II (7) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, SAMPLE shall provide for mechanisms to securely distribute updates for said product to ensure that vulnerabilities are fixed or mitigated in a timely manner and, where applicable for security updates, in an automatic manner. <<< @@ -744,9 +744,9 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex I Part II (8) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, -SAMPLE shall ensure that, where security updates are available to address identified security issues, they are disseminated without delay and, unless otherwise agreed between a manufacturer and a business user in relation to a tailor-made product with digital elements, free of charge, accompanied by advisory messages providing users with the relevant information, including on potential action to be taken. +SAMPLE shall ensure that, where security updates are available to address identified security issues, they are disseminated without delay and, unless otherwise agreed between a manufacturer and a business user in relation to a tailor-made SAMPLE product, free of charge, accompanied by advisory messages providing users with the relevant information, including on potential action to be taken. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -771,7 +771,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex II (1)(a) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, SAMPLE shall expose said product accompanied by the name, registered trade name or registered trademark of the manufacturer. <<< @@ -790,7 +790,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex II (1)(b) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, SAMPLE shall expose said product accompanied by the postal address at which the manufacturer can be contacted. <<< @@ -809,7 +809,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex II (1)(c) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, SAMPLE shall expose said product accompanied by the email address or other digital contact at which the manufacturer can be contacted. <<< @@ -828,7 +828,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex II (1)(d) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, SAMPLE shall expose said product accompanied by, where available, the website at which the manufacturer can be contacted. <<< @@ -847,9 +847,9 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex II (2)(a) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, -SAMPLE shall expose said product accompanied by the single point of contact where information about vulnerabilities of the product with digital elements can be reported and received. +SAMPLE shall expose said product accompanied by the single point of contact where information about vulnerabilities of the SAMPLE product can be reported and received. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -866,7 +866,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex II (2)(b) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, SAMPLE shall expose said product accompanied by where the manufacturer’s policy on coordinated vulnerability disclosure can be found. <<< @@ -885,7 +885,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex II (3) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, SAMPLE shall expose said product accompanied by name and type and any additional information enabling the unique identification of said product. <<< @@ -904,7 +904,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex II (4) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, SAMPLE shall expose said product accompanied by the intended purpose of said product, including: @@ -927,9 +927,9 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex II (5)(a) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, -SAMPLE shall expose said product accompanied by any known or foreseeable circumstance, related to the use of the product with digital elements in accordance with its intended purpose, which may lead to significant cybersecurity risks. +SAMPLE shall expose said product accompanied by any known or foreseeable circumstance, related to the use of the SAMPLE product in accordance with its intended purpose, which may lead to significant cybersecurity risks. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -946,9 +946,9 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex II (5)(b) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, -SAMPLE shall expose said product accompanied by any known or foreseeable circumstance, related to the use of the product with digital elements under conditions of reasonably foreseeable misuse, which may lead to significant cybersecurity risks. +SAMPLE shall expose said product accompanied by any known or foreseeable circumstance, related to the use of the SAMPLE product under conditions of reasonably foreseeable misuse, which may lead to significant cybersecurity risks. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -965,7 +965,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex II (6) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, SAMPLE shall expose said product accompanied by where applicable, the internet address at which the EU declaration of conformity can be accessed. <<< @@ -984,7 +984,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex II (7)(a) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, SAMPLE shall expose said product accompanied by the type of technical security support offered by the manufacturer. <<< @@ -1003,7 +1003,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex II (7)(b) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, SAMPLE shall expose said product accompanied by the end-date of the support period during which users can expect: @@ -1025,9 +1025,9 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex II (8)(a) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, -SAMPLE shall expose said product accompanied by detailed instructions or an internet address referring to such detailed instructions and information on the necessary measures during initial commissioning and throughout the lifetime of the product with digital elements to ensure its secure use. +SAMPLE shall expose said product accompanied by detailed instructions or an internet address referring to such detailed instructions and information on the necessary measures during initial commissioning and throughout the lifetime of the SAMPLE product to ensure its secure use. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -1044,7 +1044,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex II (8)(b) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, SAMPLE shall expose said product accompanied by detailed instructions or an internet address referring to such detailed instructions and information on how changes to said product can affect the security of data. <<< @@ -1063,7 +1063,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex II (8)(c) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, SAMPLE shall expose said product accompanied by detailed instructions or an internet address referring to such detailed instructions and information on how security-relevant updates can be installed for said product. <<< @@ -1082,7 +1082,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex II (8)(d) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, SAMPLE shall expose said product accompanied by detailed instructions or an internet address referring to such detailed instructions and information on the secure decommissioning of said product, including information on how user data can be securely removed. <<< @@ -1101,7 +1101,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex II (8)(e) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, SAMPLE shall expose said product accompanied by detailed instructions or an internet address referring to such detailed instructions and information on how the default setting enabling the automatic installation of security updates can be turned off. <<< @@ -1120,7 +1120,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex II (8)(f) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, Where said product is intended for integration into other products with digital elements, @@ -1144,9 +1144,9 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex II (9) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, -Where the manufacturer of the product with digital elements decides to make available the software bill of materials to the user, +Where the manufacturer of said product decides to make available the software bill of materials to the user, SAMPLE shall expose said product accompanied by information on where the software bill of materials can be accessed. <<< @@ -1171,7 +1171,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex VII (1) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, Where the technical documentation referred to in EU CRA Article 31 shall be provided for said product, @@ -1179,7 +1179,7 @@ SAMPLE shall expose said product accompanied by technical documentation containi - the intended purpose of said product; - versions of software affecting compliance with essential cybersecurity requirements; -- where the product with digital elements is a hardware product +- where the product with dhttps://zoom.us/j/99157617857igital elements is a hardware product - photographs or illustrations showing external features, marking and internal layout; @@ -1200,11 +1200,11 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex VII (2) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, Where the technical documentation referred to in EU CRA Article 31 shall be provided for said product, -SAMPLE shall expose said product accompanied by technical documentation containing a description of the design, development and production of the product with digital elements and vulnerability handling processes, including: +SAMPLE shall expose said product accompanied by technical documentation containing a description of the design, development and production of said product and vulnerability handling processes, including: - necessary information on the design and development of said product, including, where applicable, @@ -1235,11 +1235,11 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex VII (3) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, Where the technical documentation referred to in EU CRA Article 31 shall be provided for said product, -SAMPLE shall expose said product accompanied by technical documentation containing an assessment of the cybersecurity risks against which the product with digital elements is designed, developed, produced, delivered and maintained pursuant to EU CRA Article 13, including how the essential cybersecurity requirements set out in Part I of Annex I are applicable; +SAMPLE shall expose said product accompanied by technical documentation containing an assessment of the cybersecurity risks against which said product is designed, developed, produced, delivered and maintained pursuant to EU CRA Article 13, including how the essential cybersecurity requirements set out in Part I of Annex I are applicable; <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -1256,7 +1256,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex VII (4) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, Where the technical documentation referred to in EU CRA Article 31 shall be provided for said product, @@ -1277,7 +1277,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex VII (5) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, Where the technical documentation referred to in EU CRA Article 31 shall be provided for said product, @@ -1306,7 +1306,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex VII (6) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, Where the technical documentation referred to in EU CRA Article 31 shall be provided for said product, @@ -1331,7 +1331,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex VII (7) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, Where the technical documentation referred to in EU CRA Article 31 shall be provided for said product, @@ -1352,7 +1352,7 @@ STATUS: Draft VERIFICATION: Test TITLE: SAMPLE complies with EU CRA Annex VII (8) STATEMENT: >>> -Where a SAMPLE product with digital elements is exposed to the EU marketplace, +Where a SAMPLE product is exposed to the EU marketplace, Where the technical documentation referred to in EU CRA Article 31 shall be provided for said product, From f0fe721d7b5aa00e03229d7c4d7366b6bec6c1c5 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Fri, 12 Jun 2026 10:46:41 -0700 Subject: [PATCH 088/100] soi:sample:sysreq:conf:eu_cra expand to `expose to market(s)` Signed-off-by: Gregory Shue --- .../system_requirements/sdoc/index.sdoc | 66 +++++++++---------- 1 file changed, 33 insertions(+), 33 deletions(-) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 6cfe39cda..8258ae6fb 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -78,7 +78,7 @@ STATUS: Draft VERIFICATION: Review TITLE: SAMPLE Product 1: Feature List STATEMENT: >>> -SAMPLE shall expose a product with the following features: +SAMPLE shall expose to market(s) a product with the following features: - Internal name: SAMPLE Product 1 - Product Type: USB Network Interface Dongle @@ -481,7 +481,7 @@ Where a SAMPLE product is exposed to the EU marketplace, On the basis of the cybersecurity risk assessment referred to in EU CRA Article 13(2) and where applicable, -SAMPLE shall expose said product that is designed, developed and produced to limit attack surfaces, including external interfaces. +SAMPLE shall expose to market(s) said product that is designed, developed and produced to limit attack surfaces, including external interfaces. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -502,7 +502,7 @@ Where a SAMPLE product is exposed to the EU marketplace, On the basis of the cybersecurity risk assessment referred to in EU CRA Article 13(2) and where applicable, -SAMPLE shall expose said product that is designed, developed and produced to reduce the impact of an incident using appropriate exploitation mitigation mechanisms and techniques. +SAMPLE shall expose to market(s) said product that is designed, developed and produced to reduce the impact of an incident using appropriate exploitation mitigation mechanisms and techniques. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -523,7 +523,7 @@ Where a SAMPLE product is exposed to the EU marketplace, On the basis of the cybersecurity risk assessment referred to in EU CRA Article 13(2) and where applicable, -SAMPLE shall expose said product that provides security related information by recording and monitoring relevant internal activity, including the access to or modification of data, services or functions, with an opt-out mechanism for the user. +SAMPLE shall expose to market(s) said product that provides security related information by recording and monitoring relevant internal activity, including the access to or modification of data, services or functions, with an opt-out mechanism for the user. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -544,7 +544,7 @@ Where a SAMPLE product is exposed to the EU marketplace, On the basis of the cybersecurity risk assessment referred to in EU CRA Article 13(2) and where applicable, -SAMPLE shall expose said product that provides the possibility for users to securely and easily remove on a permanent basis all data and settings and, where such data can be transferred to other products or systems, ensure that this is done in a secure manner. +SAMPLE shall expose to market(s) said product that provides the possibility for users to securely and easily remove on a permanent basis all data and settings and, where such data can be transferred to other products or systems, ensure that this is done in a secure manner. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -773,7 +773,7 @@ TITLE: SAMPLE complies with EU CRA Annex II (1)(a) STATEMENT: >>> Where a SAMPLE product is exposed to the EU marketplace, -SAMPLE shall expose said product accompanied by the name, registered trade name or registered trademark of the manufacturer. +SAMPLE shall expose to market(s) said product accompanied by the name, registered trade name or registered trademark of the manufacturer. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -792,7 +792,7 @@ TITLE: SAMPLE complies with EU CRA Annex II (1)(b) STATEMENT: >>> Where a SAMPLE product is exposed to the EU marketplace, -SAMPLE shall expose said product accompanied by the postal address at which the manufacturer can be contacted. +SAMPLE shall expose to market(s) said product accompanied by the postal address at which the manufacturer can be contacted. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -811,7 +811,7 @@ TITLE: SAMPLE complies with EU CRA Annex II (1)(c) STATEMENT: >>> Where a SAMPLE product is exposed to the EU marketplace, -SAMPLE shall expose said product accompanied by the email address or other digital contact at which the manufacturer can be contacted. +SAMPLE shall expose to market(s) said product accompanied by the email address or other digital contact at which the manufacturer can be contacted. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -830,7 +830,7 @@ TITLE: SAMPLE complies with EU CRA Annex II (1)(d) STATEMENT: >>> Where a SAMPLE product is exposed to the EU marketplace, -SAMPLE shall expose said product accompanied by, where available, the website at which the manufacturer can be contacted. +SAMPLE shall expose to market(s) said product accompanied by, where available, the website at which the manufacturer can be contacted. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -849,7 +849,7 @@ TITLE: SAMPLE complies with EU CRA Annex II (2)(a) STATEMENT: >>> Where a SAMPLE product is exposed to the EU marketplace, -SAMPLE shall expose said product accompanied by the single point of contact where information about vulnerabilities of the SAMPLE product can be reported and received. +SAMPLE shall expose to market(s) said product accompanied by the single point of contact where information about vulnerabilities of the SAMPLE product can be reported and received. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -868,7 +868,7 @@ TITLE: SAMPLE complies with EU CRA Annex II (2)(b) STATEMENT: >>> Where a SAMPLE product is exposed to the EU marketplace, -SAMPLE shall expose said product accompanied by where the manufacturer’s policy on coordinated vulnerability disclosure can be found. +SAMPLE shall expose to market(s) said product accompanied by where the manufacturer’s policy on coordinated vulnerability disclosure can be found. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -887,7 +887,7 @@ TITLE: SAMPLE complies with EU CRA Annex II (3) STATEMENT: >>> Where a SAMPLE product is exposed to the EU marketplace, -SAMPLE shall expose said product accompanied by name and type and any additional information enabling the unique identification of said product. +SAMPLE shall expose to market(s) said product accompanied by name and type and any additional information enabling the unique identification of said product. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -906,7 +906,7 @@ TITLE: SAMPLE complies with EU CRA Annex II (4) STATEMENT: >>> Where a SAMPLE product is exposed to the EU marketplace, -SAMPLE shall expose said product accompanied by the intended purpose of said product, including: +SAMPLE shall expose to market(s) said product accompanied by the intended purpose of said product, including: - the security environment provided by the manufacturer, - the product’s essential functionalities, @@ -929,7 +929,7 @@ TITLE: SAMPLE complies with EU CRA Annex II (5)(a) STATEMENT: >>> Where a SAMPLE product is exposed to the EU marketplace, -SAMPLE shall expose said product accompanied by any known or foreseeable circumstance, related to the use of the SAMPLE product in accordance with its intended purpose, which may lead to significant cybersecurity risks. +SAMPLE shall expose to market(s) said product accompanied by any known or foreseeable circumstance, related to the use of the SAMPLE product in accordance with its intended purpose, which may lead to significant cybersecurity risks. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -948,7 +948,7 @@ TITLE: SAMPLE complies with EU CRA Annex II (5)(b) STATEMENT: >>> Where a SAMPLE product is exposed to the EU marketplace, -SAMPLE shall expose said product accompanied by any known or foreseeable circumstance, related to the use of the SAMPLE product under conditions of reasonably foreseeable misuse, which may lead to significant cybersecurity risks. +SAMPLE shall expose to market(s) said product accompanied by any known or foreseeable circumstance, related to the use of the SAMPLE product under conditions of reasonably foreseeable misuse, which may lead to significant cybersecurity risks. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -967,7 +967,7 @@ TITLE: SAMPLE complies with EU CRA Annex II (6) STATEMENT: >>> Where a SAMPLE product is exposed to the EU marketplace, -SAMPLE shall expose said product accompanied by where applicable, the internet address at which the EU declaration of conformity can be accessed. +SAMPLE shall expose to market(s) said product accompanied by where applicable, the internet address at which the EU declaration of conformity can be accessed. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -986,7 +986,7 @@ TITLE: SAMPLE complies with EU CRA Annex II (7)(a) STATEMENT: >>> Where a SAMPLE product is exposed to the EU marketplace, -SAMPLE shall expose said product accompanied by the type of technical security support offered by the manufacturer. +SAMPLE shall expose to market(s) said product accompanied by the type of technical security support offered by the manufacturer. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -1005,7 +1005,7 @@ TITLE: SAMPLE complies with EU CRA Annex II (7)(b) STATEMENT: >>> Where a SAMPLE product is exposed to the EU marketplace, -SAMPLE shall expose said product accompanied by the end-date of the support period during which users can expect: +SAMPLE shall expose to market(s) said product accompanied by the end-date of the support period during which users can expect: - vulnerabilities to be handled, - to receive security updates. @@ -1027,7 +1027,7 @@ TITLE: SAMPLE complies with EU CRA Annex II (8)(a) STATEMENT: >>> Where a SAMPLE product is exposed to the EU marketplace, -SAMPLE shall expose said product accompanied by detailed instructions or an internet address referring to such detailed instructions and information on the necessary measures during initial commissioning and throughout the lifetime of the SAMPLE product to ensure its secure use. +SAMPLE shall expose to market(s) said product accompanied by detailed instructions or an internet address referring to such detailed instructions and information on the necessary measures during initial commissioning and throughout the lifetime of the SAMPLE product to ensure its secure use. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -1046,7 +1046,7 @@ TITLE: SAMPLE complies with EU CRA Annex II (8)(b) STATEMENT: >>> Where a SAMPLE product is exposed to the EU marketplace, -SAMPLE shall expose said product accompanied by detailed instructions or an internet address referring to such detailed instructions and information on how changes to said product can affect the security of data. +SAMPLE shall expose to market(s) said product accompanied by detailed instructions or an internet address referring to such detailed instructions and information on how changes to said product can affect the security of data. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -1065,7 +1065,7 @@ TITLE: SAMPLE complies with EU CRA Annex II (8)(c) STATEMENT: >>> Where a SAMPLE product is exposed to the EU marketplace, -SAMPLE shall expose said product accompanied by detailed instructions or an internet address referring to such detailed instructions and information on how security-relevant updates can be installed for said product. +SAMPLE shall expose to market(s) said product accompanied by detailed instructions or an internet address referring to such detailed instructions and information on how security-relevant updates can be installed for said product. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -1084,7 +1084,7 @@ TITLE: SAMPLE complies with EU CRA Annex II (8)(d) STATEMENT: >>> Where a SAMPLE product is exposed to the EU marketplace, -SAMPLE shall expose said product accompanied by detailed instructions or an internet address referring to such detailed instructions and information on the secure decommissioning of said product, including information on how user data can be securely removed. +SAMPLE shall expose to market(s) said product accompanied by detailed instructions or an internet address referring to such detailed instructions and information on the secure decommissioning of said product, including information on how user data can be securely removed. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -1103,7 +1103,7 @@ TITLE: SAMPLE complies with EU CRA Annex II (8)(e) STATEMENT: >>> Where a SAMPLE product is exposed to the EU marketplace, -SAMPLE shall expose said product accompanied by detailed instructions or an internet address referring to such detailed instructions and information on how the default setting enabling the automatic installation of security updates can be turned off. +SAMPLE shall expose to market(s) said product accompanied by detailed instructions or an internet address referring to such detailed instructions and information on how the default setting enabling the automatic installation of security updates can be turned off. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -1124,7 +1124,7 @@ Where a SAMPLE product is exposed to the EU marketplace, Where said product is intended for integration into other products with digital elements, -SAMPLE shall expose said product accompanied by detailed instructions or an internet address referring to such detailed instructions and information on the information necessary for the integrator to comply with: +SAMPLE shall expose to market(s) said product accompanied by detailed instructions or an internet address referring to such detailed instructions and information on the information necessary for the integrator to comply with: - the essential cybersecurity requirements set out in Annex I, - the documentation requirements set out in Annex VII. @@ -1148,7 +1148,7 @@ Where a SAMPLE product is exposed to the EU marketplace, Where the manufacturer of said product decides to make available the software bill of materials to the user, -SAMPLE shall expose said product accompanied by information on where the software bill of materials can be accessed. +SAMPLE shall expose to market(s) said product accompanied by information on where the software bill of materials can be accessed. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -1175,7 +1175,7 @@ Where a SAMPLE product is exposed to the EU marketplace, Where the technical documentation referred to in EU CRA Article 31 shall be provided for said product, -SAMPLE shall expose said product accompanied by technical documentation containing a general description of said product, including: +SAMPLE shall expose to market(s) said product accompanied by technical documentation containing a general description of said product, including: - the intended purpose of said product; - versions of software affecting compliance with essential cybersecurity requirements; @@ -1204,7 +1204,7 @@ Where a SAMPLE product is exposed to the EU marketplace, Where the technical documentation referred to in EU CRA Article 31 shall be provided for said product, -SAMPLE shall expose said product accompanied by technical documentation containing a description of the design, development and production of said product and vulnerability handling processes, including: +SAMPLE shall expose to market(s) said product accompanied by technical documentation containing a description of the design, development and production of said product and vulnerability handling processes, including: - necessary information on the design and development of said product, including, where applicable, @@ -1239,7 +1239,7 @@ Where a SAMPLE product is exposed to the EU marketplace, Where the technical documentation referred to in EU CRA Article 31 shall be provided for said product, -SAMPLE shall expose said product accompanied by technical documentation containing an assessment of the cybersecurity risks against which said product is designed, developed, produced, delivered and maintained pursuant to EU CRA Article 13, including how the essential cybersecurity requirements set out in Part I of Annex I are applicable; +SAMPLE shall expose to market(s) said product accompanied by technical documentation containing an assessment of the cybersecurity risks against which said product is designed, developed, produced, delivered and maintained pursuant to EU CRA Article 13, including how the essential cybersecurity requirements set out in Part I of Annex I are applicable; <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -1260,7 +1260,7 @@ Where a SAMPLE product is exposed to the EU marketplace, Where the technical documentation referred to in EU CRA Article 31 shall be provided for said product, -SAMPLE shall expose said product accompanied by technical documentation containing relevant information that was taken into account to determine the support period pursuant to EU CRA Article 13(8) of said product. +SAMPLE shall expose to market(s) said product accompanied by technical documentation containing relevant information that was taken into account to determine the support period pursuant to EU CRA Article 13(8) of said product. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -1281,7 +1281,7 @@ Where a SAMPLE product is exposed to the EU marketplace, Where the technical documentation referred to in EU CRA Article 31 shall be provided for said product, -SAMPLE shall expose said product accompanied by technical documentation containing: +SAMPLE shall expose to market(s) said product accompanied by technical documentation containing: - a list of the harmonised standards applied in full or in part the references of which have been published in the Official Journal of the European Union, common specifications as set out in Article 27 of this Regulation or European cybersecurity certification schemes adopted pursuant to Regulation (EU) 2019/881 pursuant to Article 27(8) of this Regulation; @@ -1310,7 +1310,7 @@ Where a SAMPLE product is exposed to the EU marketplace, Where the technical documentation referred to in EU CRA Article 31 shall be provided for said product, -SAMPLE shall expose said product accompanied by technical documentation containing: +SAMPLE shall expose to market(s) said product accompanied by technical documentation containing: - reports of the tests carried out to verify the conformity of said product, @@ -1335,7 +1335,7 @@ Where a SAMPLE product is exposed to the EU marketplace, Where the technical documentation referred to in EU CRA Article 31 shall be provided for said product, -SAMPLE shall expose said product accompanied by technical documentation containing a copy of the EU declaration of conformity. +SAMPLE shall expose to market(s) said product accompanied by technical documentation containing a copy of the EU declaration of conformity. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. @@ -1356,7 +1356,7 @@ Where a SAMPLE product is exposed to the EU marketplace, Where the technical documentation referred to in EU CRA Article 31 shall be provided for said product, -SAMPLE shall expose said product accompanied by technical documentation containing (where applicable to said product) the software bill of materials, further to a reasoned request from a market surveillance authority provided that it is necessary in order for that authority to be able to check compliance with the essential cybersecurity requirements set out in EU CRA Annex I. +SAMPLE shall expose to market(s) said product accompanied by technical documentation containing (where applicable to said product) the software bill of materials, further to a reasoned request from a market surveillance authority provided that it is necessary in order for that authority to be able to check compliance with the essential cybersecurity requirements set out in EU CRA Annex I. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. From 318964a76e75dba88a1aa7aef69b110802254735 Mon Sep 17 00:00:00 2001 From: Greg Shue <32416235+gregshue@users.noreply.github.com> Date: Sat, 13 Jun 2026 14:22:13 -0700 Subject: [PATCH 089/100] Update conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc Co-authored-by: stevenc-stb Signed-off-by: Greg Shue <32416235+gregshue@users.noreply.github.com> --- conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc index 53c6e4d8b..7e94ead10 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc @@ -85,7 +85,7 @@ TITLE: Feature List [TEXT] STATEMENT: >>> -As a Product Lines evolves the sponsors of the Product Line may require it +As a Product Line evolves the sponsors of the Product Line may require it to support a larger solution domain than previously chosen. A best practice for Product Line Engineering is to evaluate architectures and designs for reusability in reasonably foreseeable scope growth. From ce61e22d75b8d0a0e83dcd1269f2212916ced950 Mon Sep 17 00:00:00 2001 From: Greg Shue <32416235+gregshue@users.noreply.github.com> Date: Sat, 13 Jun 2026 14:22:38 -0700 Subject: [PATCH 090/100] Update conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc Co-authored-by: stevenc-stb Signed-off-by: Greg Shue <32416235+gregshue@users.noreply.github.com> --- .../content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 8258ae6fb..fac2b3918 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -1179,7 +1179,7 @@ SAMPLE shall expose to market(s) said product accompanied by technical documenta - the intended purpose of said product; - versions of software affecting compliance with essential cybersecurity requirements; -- where the product with dhttps://zoom.us/j/99157617857igital elements is a hardware product +- where the product with digital elements is a hardware product - photographs or illustrations showing external features, marking and internal layout; From d14ade900cfaa30bd11c98a0ed154e2f224b5e1c Mon Sep 17 00:00:00 2001 From: Greg Shue <32416235+gregshue@users.noreply.github.com> Date: Sat, 13 Jun 2026 14:22:50 -0700 Subject: [PATCH 091/100] Update conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc Co-authored-by: stevenc-stb Signed-off-by: Greg Shue <32416235+gregshue@users.noreply.github.com> --- .../content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index fac2b3918..2b2e57992 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -603,7 +603,7 @@ MID: a369011ad4814a3bbcc44644a1b07b89 UID: SYSREQ-24 STATUS: Draft VERIFICATION: Test -TITLE: 6.1.2.2.2. SAMPLE complies with EU CRA Annex I Part II (2)(b) +TITLE: SAMPLE complies with EU CRA Annex I Part II (2)(b) STATEMENT: >>> Where a SAMPLE product is exposed to the EU marketplace, From 9ea2643cf028f40b3263fd9066f52f6723ea9c62 Mon Sep 17 00:00:00 2001 From: Greg Shue <32416235+gregshue@users.noreply.github.com> Date: Sat, 13 Jun 2026 14:23:02 -0700 Subject: [PATCH 092/100] Update conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc Co-authored-by: stevenc-stb Signed-off-by: Greg Shue <32416235+gregshue@users.noreply.github.com> --- .../content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 2b2e57992..074c495e5 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -689,7 +689,7 @@ TITLE: SAMPLE complies with EU CRA Annex I Part II (5) STATEMENT: >>> Where a SAMPLE product is exposed to the EU marketplace, -SAMPLE shall have fin place and enforce a policy on coordinated vulnerability disclosure. +SAMPLE shall have in place and enforce a policy on coordinated vulnerability disclosure. <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. From 56eec7e2c5beff40789d0a8e4d06b6daba057e68 Mon Sep 17 00:00:00 2001 From: Greg Shue <32416235+gregshue@users.noreply.github.com> Date: Sun, 14 Jun 2026 11:50:47 -0700 Subject: [PATCH 093/100] Update index.sdoc Co-authored-by: stevenc-stb Signed-off-by: Greg Shue <32416235+gregshue@users.noreply.github.com> --- .../content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 074c495e5..6bf6789d1 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -418,7 +418,7 @@ Where a SAMPLE product is exposed to the EU marketplace, On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where applicable, -SAMPLE shall process by said product only data, personal or ohttps://zoom.us/j/99157617857ther, that are adequate, relevant and limited to what is necessary in relation to the intended purpose of said product (data minimisation). +SAMPLE shall process by said product only data, personal or other, that are adequate, relevant and limited to what is necessary in relation to the intended purpose of said product (data minimisation). <<< RATIONALE: >>> This only is required of products exposed to the EU marketplace. From 4dda8df2f832048cb51cf17ef338542bcf0c4da6 Mon Sep 17 00:00:00 2001 From: Greg Shue <32416235+gregshue@users.noreply.github.com> Date: Sun, 14 Jun 2026 11:50:56 -0700 Subject: [PATCH 094/100] Update index.sdoc Co-authored-by: stevenc-stb Signed-off-by: Greg Shue <32416235+gregshue@users.noreply.github.com> --- .../content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 6bf6789d1..64e6f30db 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -26,7 +26,7 @@ From `SEBoK Wiki Glossary - system requirement >> -From `SEBoK Wiki System Requirements Definition - Cateorizing Requirements `_ Table 1: Example Types of Requirement Categories. (Derived from the INCOSE Needs and Requirements Manual): +From `SEBoK Wiki System Requirements Definition - Categorizing Requirements `_ Table 1: Example Types of Requirement Categories. (Derived from the INCOSE Needs and Requirements Manual): **Function/Performance**: The primary functions and associated performance that the SoI needs to perform in terms of its intended use. From a9c267fc3452e383692f726cb7797086074a373b Mon Sep 17 00:00:00 2001 From: Greg Shue <32416235+gregshue@users.noreply.github.com> Date: Mon, 15 Jun 2026 09:05:20 -0700 Subject: [PATCH 095/100] Update conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc Co-authored-by: stevenc-stb Signed-off-by: Greg Shue <32416235+gregshue@users.noreply.github.com> --- .../content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 64e6f30db..ab2d89c64 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -107,7 +107,7 @@ STATUS: Draft VERIFICATION: Review TITLE: SAMPLE Product 1: Dimensions STATEMENT: >>> -Where SAMPLE Product 1 is exposed, +Where SAMPLE Product 1 is exposed to market(s), SAMPLE shall limit said SAMPLE Product physical bounds to the SAMPLE USB Network Interface Dongle Dimension Limits. <<< RATIONALE: >>> From ff1cc1ae3dbb8e0d681fa958f9e21c0cc9bd02b0 Mon Sep 17 00:00:00 2001 From: Greg Shue <32416235+gregshue@users.noreply.github.com> Date: Mon, 15 Jun 2026 09:05:48 -0700 Subject: [PATCH 096/100] Update conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc Co-authored-by: stevenc-stb Signed-off-by: Greg Shue <32416235+gregshue@users.noreply.github.com> --- .../content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index ab2d89c64..34943141a 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -121,7 +121,7 @@ STATUS: Draft VERIFICATION: Review TITLE: SAMPLE Product 1: Operating Environment STATEMENT: >>> -Where SAMPLE Product 1 is exposed, +Where SAMPLE Product 1 is exposed to market(s), SAMPLE shall operate SAMPLE Product 1 at full functionality within the SAMPLE Commercial Office Environment Limits. <<< RATIONALE: >>> From 20c021c86576679f07bba9a8dff65bb85111d7a5 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Mon, 15 Jun 2026 09:30:37 -0700 Subject: [PATCH 097/100] fix strictdoc_config statistics generation Signed-off-by: Gregory Shue --- conformance/example1/content/src/strictdoc_config.py | 1 - 1 file changed, 1 deletion(-) diff --git a/conformance/example1/content/src/strictdoc_config.py b/conformance/example1/content/src/strictdoc_config.py index d408ad970..04e67631d 100644 --- a/conformance/example1/content/src/strictdoc_config.py +++ b/conformance/example1/content/src/strictdoc_config.py @@ -71,7 +71,6 @@ def create_config() -> ProjectConfig: reqif_multiline_is_xhtml=True, reqif_enable_mid=True, section_behavior="[[SECTION]]", - statistics_generator="docs.sdoc_project_statistics.SDocStatisticsGenerator", ) return config From b9467c4e9ec94f39ed68c915028f6de3a86ed948 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Fri, 19 Jun 2026 08:14:26 -0700 Subject: [PATCH 098/100] soi:sample:sysreq:prd:netIfc:prd1 fix nested bullets formatting Signed-off-by: Gregory Shue --- .../content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc | 3 +++ 1 file changed, 3 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc index 34943141a..eb01a78bb 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/system_requirements/sdoc/index.sdoc @@ -84,9 +84,12 @@ SAMPLE shall expose to market(s) a product with the following features: - Product Type: USB Network Interface Dongle - Communication Interfaces: USB-C (male), Ethernet 100Base-T (RJ-45 socket) - User Interface: + - Status LED(s) - physical Command Button(s) + - Product label, showing: + - Manufacturer Name (clear text) - Product Model (clear text) - Product Serial Number From 8b8485bf4313d5a6444b780d6e927ce72bea3b54 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Fri, 26 Jun 2026 14:23:59 -0700 Subject: [PATCH 099/100] soi:sample: define commodity device Signed-off-by: Gregory Shue --- .../content/src/SOI/SAMPLE/sdoc/index.sdoc | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc b/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc index 7e94ead10..5e6424ab6 100644 --- a/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc +++ b/conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc @@ -21,6 +21,21 @@ markets requiring conformance with the EU Cyber Resilience Act. The range of devices supported by this Product Line is expected to expand over time as more product types become commoditized. +For this Product Line, "commodity devices" matches this definition from +`SUSE.com `__: + + Commodity hardware, sometimes known as off-the-shelf hardware, + is a computer device or IT component that is relatively inexpensive, + widely available and basically interchangeable with other hardware of its type. + Unlike purpose-built hardware designed for a specific IT function, + commodity hardware can perform many different functions. + Commodity hardware is usually low-end, broadly compatible and + can function on a plug-and-play basis with other commodity hardware products. ... + + Generally, commodity hardware can evolve from any technologically mature product. + Thus, most hardware products that have been on the market for five years or more + are available in commodity versions. ... + SAMPLE is expected to be **reused and extended** by interested Open-Source Software Projects and Component Manufacturers for developing assets conformant with the EU CRA. From cd747506bbe7aa1c06c9e1e6a7f784383e32cee5 Mon Sep 17 00:00:00 2001 From: Gregory Shue Date: Fri, 26 Jun 2026 14:38:24 -0700 Subject: [PATCH 100/100] note describing sdoc item use for normative vs informative content Signed-off-by: Gregory Shue --- conformance/example1/content/src/index.sdoc | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/conformance/example1/content/src/index.sdoc b/conformance/example1/content/src/index.sdoc index 5bb21466e..b335e34ae 100644 --- a/conformance/example1/content/src/index.sdoc +++ b/conformance/example1/content/src/index.sdoc @@ -1,6 +1,13 @@ [DOCUMENT] TITLE: SEBoK Product as System - Commodity Consumer Electronics +[TEXT] +STATEMENT: >>> +NOTE: Normative content is captured in structured, traceable StrictDoc items. + +StrictDoc `[TEXT]` blocks are unstructured and hold only informative content. +<<< + [DOCUMENT_FROM_FILE] FILE: problem_space/sdoc/index.sdoc