---
title: CRA 控制項標題與建議證據（英文版）
subtitle: 每條控制項的英文標題與該收什麼證據，灌進框架當控制項標題與建議證據（guidance）
eyebrow: FR-135 CRA 合規框架 · 已灌入框架、待顧問確認 · 2026-10-12
lede: 法條只寫產品要做到什麼，沒寫怎麼證明。這份列框架 48 條控制項的建議證據（標題表為 48 條控制項各擬一個英文標題）：交什麼檔、檔裡要看到什麼、證據從哪來。每條控制項都拆了評估目標（AO），建議證據掛在各 AO 底下（見 cra-assessment-objectives.md）。
---

## 使用前須知

- **狀態：已灌入框架，待顧問日後確認。** 建議證據是 AI 依法條與 ENISA 子要求推出來的詮釋，不是官方內容；決策者裁定不擋出貨，顧問確認有誤時以框架新版本或補灌修正。
- **依據**：法條原文（Regulation (EU) 2024/2847 Annex I、II 與 Article 13、14，見 `docs/reference/CRA/`）與 ENISA／JRC 對照報告（JRC137340，2024）的子要求；逐條對照見同資料夾 `enisa-mapping-worksheet.md`。不是官方清單，也不是調和標準；ENISA 與 EN 40000 的文字不抄進框架。
- **為什麼全英文**：框架層沒有多語機制，一本框架只能存一種語言；CRA 的讀者是歐洲客戶與公告機構，比照 CMMC 全英文。法條原文（statement）不動。
- **三段式**：每點寫 `Deliverable`（交什麼檔或紀錄）、`Must show`（審閱者要在裡面看到什麼）、`Evidence`（`upload` 客戶自有檔上傳／`system — <頁面>` 系統其他頁填完就有、不該再上傳／`template — <範本>` 系統範本產出）。標 `(Phase N)` 的系統落點是之後才上線的功能，在那之前先上傳。
- **改內容改 `scripts/cra_ao_content.py`，再跑 `python scripts/gen_cra_ao_restructure.py`**：本檔「建議證據」段（標記之間）、`cra-assessment-objectives.md` 與 jedi-oscal-v2 seed 005 一起重產。標題表不在產生範圍，改標題要同步改 002 seed。
- **EN 40000-1-4 出版後要替換。** CRA 調和標準預估 2027 年出版，屆時以框架新版本替換，舊專案沿用舊版。
- **對 Default 類自評客戶夠用；Class I／II 要找公告機構的客戶只能當準備用。**
- **控制項代號以 seed 為準**：`CRA.I.*`／`CRA.II.*`／`CRA.A2.*`／`CRA.ART.*`（Annex II 用 A2，因為 CRA 的 Annex III 是重要產品清單，用 III 會誤讀）。

## Control titles

Titles are self-drafted (the regulation has no item headings), following the CMMC title style: noun phrase, title case, at most 8 words. The basis column quotes the phrase each title is taken from.

| Control | Title | Basis (legal text) |
|---|---|---|
| CRA.I.1 | Risk-Based Cybersecurity by Design | Part I (1): "designed, developed and produced … an appropriate level of cybersecurity based on the risks" |
| CRA.I.2.a | No Known Exploitable Vulnerabilities | Part I (2)(a): "without known exploitable vulnerabilities" |
| CRA.I.2.b | Secure-by-Default Configuration & Reset | Part I (2)(b): "a secure by default configuration … including the possibility to reset the product to its original state" |
| CRA.I.2.c | Security Updates & Automatic Updating | Part I (2)(c): "addressed through security updates, including … automatic security updates" |
| CRA.I.2.d | Protection from Unauthorised Access | Part I (2)(d): "protection from unauthorised access by appropriate control mechanisms" |
| CRA.I.2.e | Data Confidentiality | Part I (2)(e): "protect the confidentiality of stored, transmitted or otherwise processed data" |
| CRA.I.2.f | Integrity of Data, Programs & Configuration | Part I (2)(f): "protect the integrity of … data … commands, programs and configuration" |
| CRA.I.2.g | Data Minimisation | Part I (2)(g): "limited to what is necessary … (data minimisation)" |
| CRA.I.2.h | Availability of Essential & Basic Functions | Part I (2)(h): "protect the availability of essential and basic functions, also after an incident" |
| CRA.I.2.i | Limiting Impact on Other Devices & Networks | Part I (2)(i): "minimise the negative impact … on the availability of services provided by other devices or networks" |
| CRA.I.2.j | Attack Surface Limitation | Part I (2)(j): "limit attack surfaces, including external interfaces" |
| CRA.I.2.k | Exploitation Mitigation & Incident Impact Reduction | Part I (2)(k): "reduce the impact of an incident using appropriate exploitation mitigation mechanisms" |
| CRA.I.2.l | Recording & Monitoring of Internal Activity | Part I (2)(l): "recording and monitoring relevant internal activity" |
| CRA.I.2.m | Secure Data Removal & Transfer | Part I (2)(m): "securely and easily remove on a permanent basis all data and settings … transferred … in a secure manner" |
| CRA.II.1 | Vulnerability & Component Identification (SBOM) | Part II (1): "identify and document vulnerabilities and components … software bill of materials" |
| CRA.II.2 | Timely Vulnerability Remediation | Part II (2): "address and remediate vulnerabilities without delay" |
| CRA.II.3 | Regular Security Testing & Review | Part II (3): "effective and regular tests and reviews of the security" |
| CRA.II.4 | Public Disclosure of Fixed Vulnerabilities | Part II (4): "share and publicly disclose information about fixed vulnerabilities" |
| CRA.II.5 | Coordinated Vulnerability Disclosure Policy | Part II (5): "a policy on coordinated vulnerability disclosure" |
| CRA.II.6 | Vulnerability Information Sharing & Reporting Contact | Part II (6): "facilitate the sharing of information about potential vulnerabilities … providing a contact address" |
| CRA.II.7 | Secure Update Distribution | Part II (7): "mechanisms to securely distribute updates" |
| CRA.II.8 | Timely, Free Security Updates with Advisories | Part II (8): "disseminated without delay and … free of charge, accompanied by advisory messages" |
| CRA.A2.1 | Manufacturer Identity & Contact Details | Annex II (1): "the name … of the manufacturer, and the postal address, the email address or other digital contact" |
| CRA.A2.2 | Vulnerability Reporting Contact & CVD Policy | Annex II (2): "the single point of contact … and where the manufacturer's policy on coordinated vulnerability disclosure can be found" |
| CRA.A2.3 | Product Identification | Annex II (3): "name and type and any additional information enabling the unique identification" |
| CRA.A2.4 | Intended Purpose & Security Properties | Annex II (4): "the intended purpose … essential functionalities and information about the security properties" |
| CRA.A2.5 | Foreseeable Significant Cybersecurity Risks | Annex II (5): "known or foreseeable circumstance … which may lead to significant cybersecurity risks" |
| CRA.A2.6 | EU Declaration of Conformity Address | Annex II (6): "the internet address at which the EU declaration of conformity can be accessed" |
| CRA.A2.7 | Security Support Type & End Date | Annex II (7): "the type of technical security support … and the end-date of the support period" |
| CRA.A2.8 | Detailed Secure-Use Instructions | Annex II (8): "detailed instructions … and information on" items (a)–(f) |
| CRA.A2.9 | SBOM Access Information | Annex II (9): "information on where the software bill of materials can be accessed" |
| CRA.A7.1 | General Description of the Product | Annex VII (1): "a general description of the product with digital elements, including: (a) its intended purpose" |
| CRA.A7.2 | Design, Development, Production and Vulnerability Handling | Annex VII (2): "a description of the design, development and production of the product with digital elements and vulnerability handling processes" |
| CRA.A7.3 | Cybersecurity Risk Assessment in the Technical Documentation | Annex VII (3): "an assessment of the cybersecurity risks against which the product with digital elements is designed, developed, produced, delivered and maintained" |
| CRA.A7.4 | Support Period Determination | Annex VII (4): "relevant information that was taken into account to determine the support period" |
| CRA.A7.5 | Standards Applied and Alternative Solutions | Annex VII (5): "a list of the harmonised standards applied in full or in part" |
| CRA.A7.6 | Conformity Test Reports | Annex VII (6): "reports of the tests carried out to verify the conformity of the product with digital elements" |
| CRA.A7.7 | Copy of the EU Declaration of Conformity | Annex VII (7): "a copy of the EU declaration of conformity" |
| CRA.A7.8 | Software Bill of Materials on Request | Annex VII (8): "where applicable, the software bill of materials, further to a reasoned request from a market surveillance authority" |
| CRA.ART.13.RA | Cybersecurity Risk Assessment | Art. 13(2)(3): "an assessment of the cybersecurity risks" |
| CRA.ART.13.TD | Technical Documentation | Art. 13(12): "manufacturers shall draw up the technical documentation referred to in Article 31" |
| CRA.ART.13.CA | Conformity Assessment Procedure | Art. 13(12): "carry out the chosen conformity assessment procedures as referred to in Article 32" |
| CRA.ART.13.DOC | EU Declaration of Conformity and CE Marking | Art. 13(12): "draw up the EU declaration of conformity in accordance with Article 28 and affix the CE marking" |
| CRA.ART.13.SP | Support Period | Art. 13(8): "the support period shall be at least five years" |
| CRA.ART.14.RP | Reporting of Exploited Vulnerabilities and Severe Incidents | Art. 14(1)(3): "notify any actively exploited vulnerability … any severe incident" |
| CRA.ART.13.REC | Record Keeping and Requests from Authorities | Art. 13(13): "keep the technical documentation and the EU declaration of conformity at the disposal of the market surveillance authorities for at least 10 years" |
| CRA.ART.13.CORR | Corrective Action and Cessation of Operations | Art. 13(21): "immediately take the corrective measures necessary to bring that product … into conformity, or to withdraw or recall the product" |
| CRA.ART.13.SER | Continued Conformity of Releases | Art. 13(14): "procedures are in place for products with digital elements that are part of a series of production to remain in conformity" |

<!-- gen:evidence:start -->

## Annex I Part I（14）

### CRA.I.1 Risk-Based Cybersecurity by Design

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex I Part I (1)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_I); [CRA Art. 13(1)(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_13)
- Implementing acts and guidance: [European Commission CRA page and implementation guidance](https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act)
- Practical examples: [NIST SP 800-218 Secure Software Development Framework (SSDF)](https://csrc.nist.gov/pubs/sp/800/218/final); [OWASP Threat Modeling Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html)

### CRA.I.2.a No Known Exploitable Vulnerabilities

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex I Part I (2)(a)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_I)
- Practical examples: [CISA Known Exploited Vulnerabilities Catalog (KEV)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog); [FIRST Common Vulnerability Scoring System (CVSS)](https://www.first.org/cvss/); [NIST SP 800-218 Secure Software Development Framework (SSDF)](https://csrc.nist.gov/pubs/sp/800/218/final)

### CRA.I.2.b Secure-by-Default Configuration & Reset

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex I Part I (2)(b)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_I)
- Practical examples: [OWASP Docker Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html); [OWASP Application Security Verification Standard (ASVS)](https://owasp.org/www-project-application-security-verification-standard/)

### CRA.I.2.c Security Updates & Automatic Updating

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex I Part I (2)(c)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_I); [CRA Recital (56) (automatic updates not expected in professional environments)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#rct_56)
- Practical examples: [The Update Framework (TUF)](https://theupdateframework.io/); [Ubuntu release and support cycle](https://ubuntu.com/about/release-cycle)

### CRA.I.2.d Protection from Unauthorised Access

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex I Part I (2)(d)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_I)
- Practical examples: [OWASP Authentication Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html); [OWASP Authorization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html); [OWASP Application Security Verification Standard (ASVS)](https://owasp.org/www-project-application-security-verification-standard/)

### CRA.I.2.e Data Confidentiality

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex I Part I (2)(e)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_I)
- Practical examples: [OWASP Transport Layer Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html); [OWASP Cryptographic Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html)

### CRA.I.2.f Integrity of Data, Programs & Configuration

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex I Part I (2)(f)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_I)
- Practical examples: [SLSA supply-chain integrity framework](https://slsa.dev/); [OWASP Cryptographic Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html)

### CRA.I.2.g Data Minimisation

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex I Part I (2)(g)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_I)
- Practical examples: [OWASP User Privacy Protection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/User_Privacy_Protection_Cheat_Sheet.html)

### CRA.I.2.h Availability of Essential & Basic Functions

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex I Part I (2)(h)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_I)
- Practical examples: [OWASP Denial of Service Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Denial_of_Service_Cheat_Sheet.html)

### CRA.I.2.i Limiting Impact on Other Devices & Networks

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex I Part I (2)(i)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_I)
- Practical examples: [OWASP Denial of Service Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Denial_of_Service_Cheat_Sheet.html)

### CRA.I.2.j Attack Surface Limitation

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex I Part I (2)(j)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_I)
- Practical examples: [OWASP Attack Surface Analysis Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Attack_Surface_Analysis_Cheat_Sheet.html)

### CRA.I.2.k Exploitation Mitigation & Incident Impact Reduction

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex I Part I (2)(k)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_I)
- Practical examples: [OWASP Docker Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html)

### CRA.I.2.l Recording & Monitoring of Internal Activity

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex I Part I (2)(l)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_I)
- Practical examples: [OWASP Logging Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html)

### CRA.I.2.m Secure Data Removal & Transfer

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex I Part I (2)(m)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_I)
- Practical examples: [NIST SP 800-88 Guidelines for Media Sanitization](https://csrc.nist.gov/pubs/sp/800/88/r1/final)

## Annex I Part II（8）

### CRA.II.1 Vulnerability & Component Identification (SBOM)

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex I Part II (1)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_I); [CRA Art. 13(5)(24)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_13)
- Practical examples: [CycloneDX specification](https://cyclonedx.org/specification/overview/); [SPDX specification](https://spdx.dev/)

### CRA.II.2 Timely Vulnerability Remediation

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex I Part II (2)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_I); [CRA Art. 13(6)(10)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_13)
- Practical examples: [FIRST Common Vulnerability Scoring System (CVSS)](https://www.first.org/cvss/); [CISA Known Exploited Vulnerabilities Catalog (KEV)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

### CRA.II.3 Regular Security Testing & Review

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex I Part II (3)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_I)
- Practical examples: [OWASP Web Security Testing Guide (WSTG)](https://owasp.org/www-project-web-security-testing-guide/); [OWASP Application Security Verification Standard (ASVS)](https://owasp.org/www-project-application-security-verification-standard/)

### CRA.II.4 Public Disclosure of Fixed Vulnerabilities

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex I Part II (4)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_I)
- Practical examples: [OASIS CSAF 2.0 security advisory format](https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.html); [FIRST Common Vulnerability Scoring System (CVSS)](https://www.first.org/cvss/)

### CRA.II.5 Coordinated Vulnerability Disclosure Policy

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex I Part II (5)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_I); [CRA Art. 13(8) sixth subparagraph](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_13)
- Practical examples: [OWASP Vulnerability Disclosure Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Vulnerability_Disclosure_Cheat_Sheet.html); [RFC 9116 security.txt](https://www.rfc-editor.org/rfc/rfc9116)

### CRA.II.6 Vulnerability Information Sharing & Reporting Contact

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex I Part II (6)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_I); [CRA Art. 13(17)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_13)
- Practical examples: [OWASP Vulnerability Disclosure Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Vulnerability_Disclosure_Cheat_Sheet.html); [RFC 9116 security.txt](https://www.rfc-editor.org/rfc/rfc9116)

### CRA.II.7 Secure Update Distribution

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex I Part II (7)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_I)
- Practical examples: [The Update Framework (TUF)](https://theupdateframework.io/); [SLSA supply-chain integrity framework](https://slsa.dev/)

### CRA.II.8 Timely, Free Security Updates with Advisories

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex I Part II (8)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_I); [CRA Art. 13(9)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_13)
- Practical examples: [OASIS CSAF 2.0 security advisory format](https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.html)

## Annex II（9）

### CRA.A2.1 Manufacturer Identity & Contact Details

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex II (1)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_II); [CRA Art. 13(16)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_13)

### CRA.A2.2 Vulnerability Reporting Contact & CVD Policy

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex II (2)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_II); [CRA Art. 13(17)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_13)
- Practical examples: [RFC 9116 security.txt](https://www.rfc-editor.org/rfc/rfc9116)

### CRA.A2.3 Product Identification

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex II (3)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_II); [CRA Art. 13(15)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_13)

### CRA.A2.4 Intended Purpose & Security Properties

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex II (4)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_II)

### CRA.A2.5 Foreseeable Significant Cybersecurity Risks

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex II (5)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_II); [CRA Art. 13(3)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_13)

### CRA.A2.6 Access to the EU Declaration of Conformity

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex II (6)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_II); [CRA Art. 13(20)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_13); [Annex VI (simplified declaration)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_VI)

### CRA.A2.7 Security Support Type & End Date

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex II (7)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_II); [CRA Art. 13(8)(19)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_13)
- Practical examples: [Microsoft product lifecycle](https://learn.microsoft.com/lifecycle/); [Ubuntu release and support cycle](https://ubuntu.com/about/release-cycle)

### CRA.A2.8 Detailed Secure-Use Instructions

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex II (8)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_II); [CRA Art. 13(18)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_13)

### CRA.A2.9 SBOM Access Information

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex II (9)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_II); [Annex VII (8)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_VII)
- Practical examples: [CycloneDX specification](https://cyclonedx.org/specification/overview/); [SPDX specification](https://spdx.dev/)

## Annex VII（8）

### CRA.A7.1 General Description of the Product

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex VII (1)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_VII); [Annex II](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_II)

### CRA.A7.2 Design, Development, Production and Vulnerability Handling

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex VII (2)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_VII); [Annex I Part II](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_I)

### CRA.A7.3 Cybersecurity Risk Assessment in the Technical Documentation

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex VII (3)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_VII); [CRA Art. 13(2)(3)(4)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_13)

### CRA.A7.4 Support Period Determination

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex VII (4)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_VII); [CRA Art. 13(8)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_13)

### CRA.A7.5 Standards Applied and Alternative Solutions

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex VII (5)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_VII); [CRA Art. 27](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_27)

### CRA.A7.6 Conformity Test Reports

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex VII (6)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_VII); [Annex I](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_I)

### CRA.A7.7 Copy of the EU Declaration of Conformity

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex VII (7)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_VII); [CRA Art. 28](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_28)

### CRA.A7.8 Software Bill of Materials on Request

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Annex VII (8)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_VII); [CRA Art. 13(22)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_13)

## Article 13 — before placing on the market（4）

### CRA.ART.13.RA Cybersecurity Risk Assessment

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Art. 13(2)(3)(4)(7)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_13); [Annex VII (3)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_VII)
- Practical examples: [OWASP Threat Modeling Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html)

### CRA.ART.13.TD Technical Documentation

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Art. 13(12)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_13); [CRA Art. 31](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_31); [Annex VII](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_VII)
- Implementing acts and guidance: [European Commission CRA page and implementation guidance](https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act)

### CRA.ART.13.CA Conformity Assessment Procedure

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Art. 32](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_32); [Annex VIII](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_VIII); [CRA Art. 7 and 8, Annexes III and IV (classification)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_7)
- Implementing acts and guidance: [Implementing Regulation (EU) 2025/2392 (technical description of important and critical products)](https://eur-lex.europa.eu/eli/reg_impl/2025/2392/oj); [European Commission CRA page and implementation guidance](https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act)

### CRA.ART.13.DOC EU Declaration of Conformity and CE Marking

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Art. 13(12)(20)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_13); [CRA Art. 28](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_28); [CRA Art. 30](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_30); [Annex V](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_V); [Annex VI](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_VI)
- Implementing acts and guidance: [European Commission CRA implementation FAQ](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act-implementation-frequently-asked-questions)

## Articles 13 and 14 — after placing on the market（5）

### CRA.ART.13.SP Support Period

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Art. 13(8)(9)(10)(19)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_13); [Annex VII (4)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_VII)
- Implementing acts and guidance: [European Commission CRA page and implementation guidance](https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act)
- Practical examples: [Microsoft product lifecycle](https://learn.microsoft.com/lifecycle/); [Ubuntu release and support cycle](https://ubuntu.com/about/release-cycle)

### CRA.ART.14.RP Reporting of Exploited Vulnerabilities and Severe Incidents

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Art. 14](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_14); [CRA Art. 16 (single reporting platform)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_16)
- Implementing acts and guidance: [ENISA Single Reporting Platform (SRP)](https://www.enisa.europa.eu/topics/product-security/vulnerability-services/eu-incident-response-and-cyber-crisis-management/single-reporting-platform-srp)
- Practical examples: [CISA Known Exploited Vulnerabilities Catalog (KEV)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

### CRA.ART.13.REC Record Keeping and Requests from Authorities

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Art. 13(13)(22)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_13); [CRA Art. 18 (authorised representatives)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_18)

### CRA.ART.13.CORR Corrective Action and Cessation of Operations

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Art. 13(21)(23)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_13); [CRA Art. 3(49)(50) (definitions of recall and withdrawal)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_3)

### CRA.ART.13.SER Continued Conformity of Releases

各 AO 的建議證據見 `cra-assessment-objectives.md`。

**References**
- Legal text: [CRA Art. 13(14)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_13); [CRA Art. 3(30) (definition of substantial modification)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_3); [CRA Art. 69(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_69)
- Implementing acts and guidance: [European Commission CRA page and implementation guidance](https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act)

<!-- gen:evidence:end -->

## 審稿留意（內部）

只給審稿人用，不灌進框架。

- **法條沒明寫、依 ENISA 保留的**：CRA.I.2.b [b] 初始帳密（法條只寫 secure by default）、CRA.I.2.l [b] 紀錄防竄改（ENISA 3.1.12）。
- **依實務加的**：CRA.II.2 [a] 依嚴重度訂修補期限（法條只寫「依風險、不延遲」，[b] 要靠它才判得了）。
- **由 Article 13 帶進來的**：CRA.II.1 [b] 第三方元件選用紀錄（Art. 13(5)）、CRA.II.6 通知元件維護者（Art. 13(6)）、CRA.A2.2 至少一種非自動化聯絡方式（Art. 13(17)）。
- **整條都在 ENISA 之外的**：CRA.I.2.m、Annex II 九條、Articles 13 and 14 三條，證據全依法條自擬。