Sherlocked Security – EU Cyber Resilience Act Compliance

Advisory, Readiness, and Technical Control Mapping for EU CRA Conformance

1. Statement of Work (SOW)

Service Name: EU Cyber Resilience Act (CRA) Compliance
Client Type: IoT Manufacturers, Software Vendors, Hardware OEMs, Critical Infrastructure Providers, EU Market Suppliers
Service Model: Compliance Readiness, Secure Development Advisory, Technical Controls Mapping, CRA Documentation Support
Compliance Coverage: EU Cyber Resilience Act (CRA), ENISA Guidance, NIS2, ISO/IEC 27001/27034, ETSI EN 303 645, OWASP MAS/ASVS

Assessment Types:

CRA Essential & Class I/II Product Classification
Lifecycle Security Controls Mapping
Secure Development & Update Policy Review
Vulnerability & Exploitability Exposure Assessment
Documentation for EU CRA Notified Body Audits

2. Our Approach

[Product Classification & CRA Scope Definition] → [Baseline Security Requirements Mapping] → [Secure Development Lifecycle Evaluation] → [Risk Assessment & Exposure Evaluation] → [Remediation Roadmap & Technical Documentation] → [Post-Fix Verification & Continuous Monitoring Strategy]

3. Methodology

[EU CRA Scope Assessment] → [Security Feature & Vulnerability Mapping] → [Conformance Assessment vs. CRA Baseline + Class-Specific Requirements] → [Lifecycle Policy Review] → [Risk & Threat Model Review] → [Supply Chain & SBOM Validation] → [Deliverables & Audit-Ready Documentation]

4. Deliverables to the Client

CRA Scope Definition & Product Risk Classification Report
Gap Analysis Report vs. CRA Baseline & Class I/II Controls
Threat & Vulnerability Exposure Summary
Lifecycle Management Policies (Support, Update, Patching)
Secure-by-Design Guidance for Product Development Teams
Security Incident Handling & Patch Management Plan
Conformance Roadmap & Audit-Ready Documentation Pack
SBOM with Vulnerability Linking (e.g., VEX, CVE tracking)

5. What We Need from You (Client Requirements)

Detailed product architecture (hardware/software components)
SBOMs (Software Bill of Materials) or dependency manifests
Secure development lifecycle (SDLC) documentation
Patch management and update policies
Past vulnerability scan reports and known issues
Roles and responsibilities matrix for security and incident handling
Supply chain vendor list and integration points
Expected launch market and EU-specific variants

6. Tools & Technology Stack

SBOM & Dependency Tools: Syft, CycloneDX, SPDX, OWASP Dependency-Track
Vulnerability Management: Trivy, Grype, Snyk, OSS Review Toolkit
Threat Modeling: Microsoft Threat Modeling Tool, OWASP Threat Dragon
Lifecycle & Patch Management: Firmware OTA Systems, Mender.io, BalenaCloud
Compliance & Documentation: Confluence, SharePoint, CRA Template Kits
Secure Development Tools: SonarQube, Fortify, GitGuardian, GitHub Advanced Security

7. Engagement Lifecycle

1. Kickoff & Product Inventory → 2. CRA Scope & Product Class Identification → 3. Control Mapping & Gap Analysis → 4. Lifecycle & Update Policy Review → 5. Remediation & Secure Dev Advisory → 6. Final Report + Audit-Ready Documentation → 7. Post-Compliance Monitoring Strategy

8. Why Sherlocked Security?

Feature	Sherlocked Advantage
Full EU CRA Lifecycle Compliance Support	From classification to post-deployment monitoring for EU market access
Secure-by-Design & Development Expertise	Hands-on advisory for DevSecOps and embedded system security
SBOM & Supply Chain Risk Visibility	Complete SBOM generation and third-party dependency vulnerability mapping
Notified Body Documentation Preparation	Ready-to-submit documentation pack aligned with EU CRA and ENISA guidance
Integrated Risk & Vulnerability Analytics	Threat modeling, exploitability rating, and exposure prioritization

9. Real-World Case Studies

IoT Device Failing CRA Class II Requirements

Issue: A smart-home manufacturer used outdated firmware and lacked a defined update policy.
Impact: High-risk classification under CRA could block EU market access.
Fix: Defined over-the-air update process, created vulnerability disclosure policy, and generated SBOM.
Outcome: Achieved CRA compliance for Class II product and was cleared for EU distribution.

Software-as-a-Service CRA Evaluation

Issue: A B2B SaaS provider storing customer data failed to meet lifecycle support expectations.
Impact: Lacked defined support timelines, impacting CRA conformity claims.
Fix: Established 5-year patch support SLAs and real-time vulnerability alerting via GitHub security advisories.
Outcome: Met EU CRA support requirements and enabled full product launch into European markets.

10. SOP – Standard Operating Procedure

Scope Definition & Classification
- Identify whether product is “critical” or “important” under CRA.
- Map to Class I or Class II depending on potential risk to public interest, safety, or cybersecurity.
CRA Baseline & Class-Specific Requirements Mapping
- Review 4 key obligations: security by design, vulnerability handling, transparency, and support.
- Map existing controls to required CRA practices based on classification.
Secure Development Lifecycle Assessment
- Review SDLC phases: requirements → design → coding → testing → release.
- Confirm security gates (e.g., static scans, code reviews, threat modeling) are in place.
Vulnerability Management & Risk Analysis
- Identify existing vulnerabilities via SCA/SBOM tools.
- Implement VEX (Vulnerability Exploitability eXchange) where applicable.
- Rate findings based on severity, exploitability, and remediation feasibility.
Patch Management & Update Policy Review
- Verify you have mechanisms for vulnerability remediation post-sale.
- Validate timelines for issuing security patches and incident disclosures.
SBOM Generation & Supply Chain Validation
- Produce machine-readable SBOM (CycloneDX, SPDX) with CVE linkage.
- Check for outdated or unsupported third-party libraries and modules.
Final Report & Notified Body Documentation Pack
- Prepare the full technical documentation required for CRA conformance.
- Include: SBOM, update policy, secure dev evidence, vulnerability disclosure process, threat models.
Post-Compliance Monitoring Plan
- Design a continuous vulnerability alerting, monitoring, and support model.
- Integrate SBOM updates and customer-facing security notifications.

11. EU Cyber Resilience Act Compliance Checklist

1. Classification & Scope

Determine whether product is in CRA scope (digital elements, connectivity, EU market).
Identify if product falls under Class I (standard) or Class II (critical).
Define CRA obligations based on classification.

2. Security by Design Controls

Integrate threat modeling into SDLC (STRIDE, LINDDUN, etc.).
Perform static code analysis, dependency scanning, and fuzzing.
Enforce secure configuration defaults and minimal privilege enforcement.
Design product to resist common attack vectors (MITM, RCE, hardcoded secrets).

3. Secure Update & Lifecycle Support

Define patching policy with clear SLA (e.g., 90 days for known vulnerabilities).
Enable OTA (Over-The-Air) update delivery or secure desktop patch workflows.
Validate rollback protection, update integrity (signatures), and secure boot.

4. Vulnerability Handling & Transparency

Implement a Coordinated Vulnerability Disclosure (CVD) policy.
Enable customer and researcher vulnerability reporting mechanisms.
Track and publish vulnerabilities in a transparent, traceable manner.

5. SBOM & Supply Chain Security

Generate SBOMs in a standard format (CycloneDX, SPDX, or Syft output).
Identify and rate CVEs from known components using Grype, OSS Index, etc.
Confirm supply chain provenance and restrict use of unknown third-party components.

6. Documentation & Audit Readiness

Maintain CRA-required technical documentation (threat models, lifecycle plan, SBOM, CVD).
Ensure reproducibility of software builds and security configurations.
Document Class I/II conformance statements for Notified Bodies.

7. Continuous Monitoring & Post-Sale Support

Set up a program for ongoing vulnerability alerts and security patching.
Monitor upstream open-source dependency updates and emerging CVEs.
Provide security updates and advisory notices to users proactively.

EU Cyber Resilience Act Compliance