EU Cyber Resilience Act
CRA risk assessment and technical documentation
A CRA technical file needs to explain the product’s cybersecurity risks and how the manufacturer addresses them. Use Sytance to maintain the architecture, risk assessment, SBOM and verification records, then prepare the documents from the product information your team has reviewed.
For manufacturers preparing product security analysis and the records behind a conformity assessment.
UPD-01Modified firmware packageVerify package authenticityPlannedACC-01Unauthorised configuration changeCheck the role on the devicePlannedCOM-01Connection to an untrusted serverValidate peer identityPlannedReject altered packages and untrusted signing keys before installation.
Software update integrity
The update path can expose the product to modified firmware. The proposed measure checks package authenticity before installation.
- Threat record
- UPD-01 · Modified firmware package
- Security requirement
- Check signature, signing key and intended product.
- Verification evidence
- Record rejection behaviour and confirm the installed firmware remains usable.
Start with the product and its intended use
Product scope, operating conditions and interfaces determine which security questions need an answer. Sytance keeps this context alongside architecture, risk analysis and component records, so technical documentation can be reviewed against the product actually being placed on the market.
Read about CRA risk assessmentFrom analysis to verification
Follow a security decision through the records
Choose an example to see how a threat becomes a requirement and a verification activity.
Illustrative scenarios. Verification is planned; these are not executed test results.
The reviewer can examine the proposed control and the test conditions before accepting the risk decision.
Threat scenario
A modified firmware package is installed
An attacker replaces the package on the update path.
UPD-01 · ThreatCheck the signature, signing key and product identity before installation.
UPD-01 · RequirementExecute the planned tests, retain the observations and attach the supporting evidence.
- Test conditions
- To record
- Observed result
- To record
- Supporting evidence
- To attach
Attempt an update with modified content and an untrusted signing key. Record the rejection behaviour and confirm the existing firmware remains usable.
example-update-agent
Review the changed update code, package verification and interrupted-update behaviour.
After a release
Keep component and vulnerability decisions with the product
An SBOM identifies software components. The surrounding records explain whether a vulnerability affects the delivered product, which action was chosen and what was checked. Keeping these details together makes later reviews more specific.
CRA knowledge
Understand the requirement before preparing the file
Scope, assessment routes and documentation duties need to be checked for the specific product. These articles explain the distinctions and link to the primary sources.
Bring your product information into Sytance
Start with the intended use, architecture and interfaces. Your team reviews the analysis, supplies test evidence and confirms the final conformity decisions.
