FR-135 CRA 合規框架 · 已灌入框架、待顧問確認 · 2026-10-12

CRA 控制項標題與建議證據（英文版）

每條控制項的英文標題與該收什麼證據，灌進框架當控制項標題與建議證據（guidance）

法條只寫產品要做到什麼，沒寫怎麼證明。這份列框架 48 條控制項的建議證據（標題表為 48 條控制項各擬一個英文標題）：交什麼檔、檔裡要看到什麼、證據從哪來。每條控制項都拆了評估目標（AO），建議證據掛在各 AO 底下（見 cra-assessment-objectives.md）。

§1

使用前須知

狀態：已灌入框架，待顧問日後確認。 建議證據是 AI 依法條與 ENISA 子要求推出來的詮釋，不是官方內容；決策者裁定不擋出貨，顧問確認有誤時以框架新版本或補灌修正。
依據：法條原文（Regulation (EU) 2024/2847 Annex I、II 與 Article 13、14，見 docs/reference/CRA/）與 ENISA／JRC 對照報告（JRC137340，2024）的子要求；逐條對照見同資料夾 enisa-mapping-worksheet.md。不是官方清單，也不是調和標準；ENISA 與 EN 40000 的文字不抄進框架。
為什麼全英文：框架層沒有多語機制，一本框架只能存一種語言；CRA 的讀者是歐洲客戶與公告機構，比照 CMMC 全英文。法條原文（statement）不動。
三段式：每點寫 Deliverable（交什麼檔或紀錄）、Must show（審閱者要在裡面看到什麼）、Evidence（upload 客戶自有檔上傳／system — <頁面> 系統其他頁填完就有、不該再上傳／template — <範本> 系統範本產出）。標 (Phase N) 的系統落點是之後才上線的功能，在那之前先上傳。
改內容改 scripts/cra_ao_content.py，再跑 python scripts/gen_cra_ao_restructure.py：本檔「建議證據」段（標記之間）、cra-assessment-objectives.md 與 jedi-oscal-v2 seed 005 一起重產。標題表不在產生範圍，改標題要同步改 002 seed。
EN 40000-1-4 出版後要替換。 CRA 調和標準預估 2027 年出版，屆時以框架新版本替換，舊專案沿用舊版。
對 Default 類自評客戶夠用；Class I／II 要找公告機構的客戶只能當準備用。
控制項代號以 seed 為準：CRA.I.*／CRA.II.*／CRA.A2.*／CRA.ART.*（Annex II 用 A2，因為 CRA 的 Annex III 是重要產品清單，用 III 會誤讀）。

§2

Control titles

Titles are self-drafted (the regulation has no item headings), following the CMMC title style: noun phrase, title case, at most 8 words. The basis column quotes the phrase each title is taken from.

Control	Title	Basis (legal text)
CRA.I.1	Risk-Based Cybersecurity by Design	Part I (1): "designed, developed and produced … an appropriate level of cybersecurity based on the risks"
CRA.I.2.a	No Known Exploitable Vulnerabilities	Part I (2)(a): "without known exploitable vulnerabilities"
CRA.I.2.b	Secure-by-Default Configuration & Reset	Part I (2)(b): "a secure by default configuration … including the possibility to reset the product to its original state"
CRA.I.2.c	Security Updates & Automatic Updating	Part I (2)(c): "addressed through security updates, including … automatic security updates"
CRA.I.2.d	Protection from Unauthorised Access	Part I (2)(d): "protection from unauthorised access by appropriate control mechanisms"
CRA.I.2.e	Data Confidentiality	Part I (2)(e): "protect the confidentiality of stored, transmitted or otherwise processed data"
CRA.I.2.f	Integrity of Data, Programs & Configuration	Part I (2)(f): "protect the integrity of … data … commands, programs and configuration"
CRA.I.2.g	Data Minimisation	Part I (2)(g): "limited to what is necessary … (data minimisation)"
CRA.I.2.h	Availability of Essential & Basic Functions	Part I (2)(h): "protect the availability of essential and basic functions, also after an incident"
CRA.I.2.i	Limiting Impact on Other Devices & Networks	Part I (2)(i): "minimise the negative impact … on the availability of services provided by other devices or networks"
CRA.I.2.j	Attack Surface Limitation	Part I (2)(j): "limit attack surfaces, including external interfaces"
CRA.I.2.k	Exploitation Mitigation & Incident Impact Reduction	Part I (2)(k): "reduce the impact of an incident using appropriate exploitation mitigation mechanisms"
CRA.I.2.l	Recording & Monitoring of Internal Activity	Part I (2)(l): "recording and monitoring relevant internal activity"
CRA.I.2.m	Secure Data Removal & Transfer	Part I (2)(m): "securely and easily remove on a permanent basis all data and settings … transferred … in a secure manner"
CRA.II.1	Vulnerability & Component Identification (SBOM)	Part II (1): "identify and document vulnerabilities and components … software bill of materials"
CRA.II.2	Timely Vulnerability Remediation	Part II (2): "address and remediate vulnerabilities without delay"
CRA.II.3	Regular Security Testing & Review	Part II (3): "effective and regular tests and reviews of the security"
CRA.II.4	Public Disclosure of Fixed Vulnerabilities	Part II (4): "share and publicly disclose information about fixed vulnerabilities"
CRA.II.5	Coordinated Vulnerability Disclosure Policy	Part II (5): "a policy on coordinated vulnerability disclosure"
CRA.II.6	Vulnerability Information Sharing & Reporting Contact	Part II (6): "facilitate the sharing of information about potential vulnerabilities … providing a contact address"
CRA.II.7	Secure Update Distribution	Part II (7): "mechanisms to securely distribute updates"
CRA.II.8	Timely, Free Security Updates with Advisories	Part II (8): "disseminated without delay and … free of charge, accompanied by advisory messages"
CRA.A2.1	Manufacturer Identity & Contact Details	Annex II (1): "the name … of the manufacturer, and the postal address, the email address or other digital contact"
CRA.A2.2	Vulnerability Reporting Contact & CVD Policy	Annex II (2): "the single point of contact … and where the manufacturer's policy on coordinated vulnerability disclosure can be found"
CRA.A2.3	Product Identification	Annex II (3): "name and type and any additional information enabling the unique identification"
CRA.A2.4	Intended Purpose & Security Properties	Annex II (4): "the intended purpose … essential functionalities and information about the security properties"
CRA.A2.5	Foreseeable Significant Cybersecurity Risks	Annex II (5): "known or foreseeable circumstance … which may lead to significant cybersecurity risks"
CRA.A2.6	EU Declaration of Conformity Address	Annex II (6): "the internet address at which the EU declaration of conformity can be accessed"
CRA.A2.7	Security Support Type & End Date	Annex II (7): "the type of technical security support … and the end-date of the support period"
CRA.A2.8	Detailed Secure-Use Instructions	Annex II (8): "detailed instructions … and information on" items (a)–(f)
CRA.A2.9	SBOM Access Information	Annex II (9): "information on where the software bill of materials can be accessed"
CRA.A7.1	General Description of the Product	Annex VII (1): "a general description of the product with digital elements, including: (a) its intended purpose"
CRA.A7.2	Design, Development, Production and Vulnerability Handling	Annex VII (2): "a description of the design, development and production of the product with digital elements and vulnerability handling processes"
CRA.A7.3	Cybersecurity Risk Assessment in the Technical Documentation	Annex VII (3): "an assessment of the cybersecurity risks against which the product with digital elements is designed, developed, produced, delivered and maintained"
CRA.A7.4	Support Period Determination	Annex VII (4): "relevant information that was taken into account to determine the support period"
CRA.A7.5	Standards Applied and Alternative Solutions	Annex VII (5): "a list of the harmonised standards applied in full or in part"
CRA.A7.6	Conformity Test Reports	Annex VII (6): "reports of the tests carried out to verify the conformity of the product with digital elements"
CRA.A7.7	Copy of the EU Declaration of Conformity	Annex VII (7): "a copy of the EU declaration of conformity"
CRA.A7.8	Software Bill of Materials on Request	Annex VII (8): "where applicable, the software bill of materials, further to a reasoned request from a market surveillance authority"
CRA.ART.13.RA	Cybersecurity Risk Assessment	Art. 13(2)(3): "an assessment of the cybersecurity risks"
CRA.ART.13.TD	Technical Documentation	Art. 13(12): "manufacturers shall draw up the technical documentation referred to in Article 31"
CRA.ART.13.CA	Conformity Assessment Procedure	Art. 13(12): "carry out the chosen conformity assessment procedures as referred to in Article 32"
CRA.ART.13.DOC	EU Declaration of Conformity and CE Marking	Art. 13(12): "draw up the EU declaration of conformity in accordance with Article 28 and affix the CE marking"
CRA.ART.13.SP	Support Period	Art. 13(8): "the support period shall be at least five years"
CRA.ART.14.RP	Reporting of Exploited Vulnerabilities and Severe Incidents	Art. 14(1)(3): "notify any actively exploited vulnerability … any severe incident"
CRA.ART.13.REC	Record Keeping and Requests from Authorities	Art. 13(13): "keep the technical documentation and the EU declaration of conformity at the disposal of the market surveillance authorities for at least 10 years"
CRA.ART.13.CORR	Corrective Action and Cessation of Operations	Art. 13(21): "immediately take the corrective measures necessary to bring that product … into conformity, or to withdraw or recall the product"
CRA.ART.13.SER	Continued Conformity of Releases	Art. 13(14): "procedures are in place for products with digital elements that are part of a series of production to remain in conformity"

§3