You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
cra-kit: correct Art. 14 reporting mechanics; drop deleted ROADMAP refs
Fix a systematic inaccuracy across the kit: Art. 14 reports are not sent
"to ENISA" directly. They are filed via the ENISA Single Reporting Platform
(SRP) to the CSIRT designated as coordinator, with ENISA notified
simultaneously (Art. 14/16), and fixed vulnerabilities are published to the
EUVD.
- vulnerability-handling-process.md: add "how a report is filed"
(SRP -> CSIRT + ENISA -> EUVD) section; add the severe-incident track
(Art. 14(3), 1-month final report); reframe on-call from a staffing gap
to follow-the-sun coverage plus a compliance commitment; update diagram,
SLA table, and references.
- Link the EU Authorised Representative appointment to the coordinator-CSIRT
reporting end-point (Art. 14(7)) in eu-authorised-representative.md.
- Correct "notify ENISA" / "24h ENISA reporting" wording in the shortlist,
cheat sheet, glossary, slide outline, and SKILL.md.
- Add SRP / CSIRT / EUVD glossary entries; tighten support-period wording to
match Art. 13(2) (at least 5 years unless shorter expected lifetime).
- Remove internal-correspondence detail from conformity-assessment-route.md.
- Delete ROADMAP.md and remove all remaining references to it.
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
| Map **remote processing** and **connectivity** in your product (cloud, OTA, admin interfaces, telemetry) | Implementations of **state-of-the-art** secure protocols, for example: |
42
42
| Use **current cryptography** and **secure protocols** for data in transfer; document what is enabled in **your** build |**TLS** (wolfSSL), **SSH** (wolfSSH), **MQTTS** (wolfMQTT), and related stacks |
| Publish a **Coordinated Vulnerability Disclosure (CVD) policy** and a working security contact (`security.txt` per RFC 9116) so researchers can reach you | Reference templates: wolfSSL's [`security.txt`](https://www.wolfssl.com/.well-known/security.txt) and [CVD policy](https://www.wolfssl.com/.well-known/vulnerability-disclosure-policy.txt)|
57
57
| Operate a **vulnerability handling process** with named owners and stated response targets | wolfSSL [security advisories](https://www.wolfssl.com/docs/security-vulnerabilities/) for libraries you ship; wolfSSL is a CVE Numbering Authority |
58
-
|Notify **ENISAwithin 24 hours** when a vulnerability in your product is **actively exploited** (Art. 14); follow up at 72 hours and a final report at 14 days | wolfSSL handles ENISA reporting for **wolfSSL libraries placed on the EU market by wolfSSL Inc.**; coordinate with us on shared advisories |
58
+
|File via the **Single Reporting Platform** (to your coordinator CSIRT + ENISA) **within 24 hours** when a vulnerability in your product is **actively exploited** (Art. 14/16); follow up at 72 hours and a final report at 14 days | wolfSSL handles reporting for **wolfSSL libraries placed on the EU market by wolfSSL Inc.**; coordinate with us on shared advisories |
59
59
| Maintain **on-call coverage** including weekends and holidays so the 24-hour clock can be met at any time | — |
60
60
61
61
This pillar is **not satisfied by SBOM artefacts alone** — it requires
Copy file name to clipboardExpand all lines: cra-kit/CRA-Supply-Chain-Glossary.md
+6-3Lines changed: 6 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -52,7 +52,7 @@ flowchart LR
52
52
|**PURL**|**Package URL**| Standard ID like `pkg:github/wolfSSL/wolfssl@v5.9.1` — helps tools match components. wolfSSL ships PURLs in both `github` (canonical, resolves in OSV / GHSA / Snyk / Trivy) and CPE forms. |
53
53
|**CPE**|**Common Platform Enumeration**| Standard ID like `cpe:2.3:a:wolfssl:wolfssl:…` — used by many vulnerability databases. |
54
54
|**VEX**|**Vulnerability Exploitability eXchange**| CycloneDX-side signal: “this CVE does/doesn’t apply to our build.” Often layered on top of SBOM in security tools. |
55
-
|**CBOM**|**Cryptographic Bill of Materials**| Inventory of **crypto algorithms/keys/modules** (beyond generic SBOM). Today: `wolfssl:build:*` in CycloneDX; formal CBOM: see [`ROADMAP.md`](ROADMAP.md). |
55
+
|**CBOM**|**Cryptographic Bill of Materials**| Inventory of **crypto algorithms/keys/modules** (beyond generic SBOM). Today: `wolfssl:build:*` in CycloneDX; formal CBOM: on the roadmap. |
56
56
|**bomsh**| wolfSSL **make** target | Runs **OmniBOR** provenance: proves **how** the library binary was built from sources (**Linux host only**). |
57
57
|**OmniBOR**| Omni **Bill of Resources**| Merkle DAG of build inputs/outputs; stored under `omnibor/`. |
58
58
|**gitoid**| Git-object-style ID | Hash pointer (`gitoid:blob:sha1:…`) into the OmniBOR graph; appears in `omnibor.*.spdx.json`. |
@@ -82,8 +82,11 @@ that no SBOM tool can satisfy. **Not legal advice** — engage CRA counsel.
82
82
|**Declaration of conformity**| Art. 28 | Manufacturer's signed statement of CRA compliance. Names the product, lists applicable EU acts, identifies the manufacturer (and EU AR if applicable). |
83
83
|**Importer**| Art. 19 | EU entity placing a non-EU product on the EU market. Carries CRA obligations parallel to the manufacturer (verify CE mark, retain AR contact, assist regulators). |
84
84
|**Distributor**| Art. 20 | Party in the supply chain making the product available on the EU market without altering it. Lighter obligations than importer/manufacturer, but must verify CE mark and assist regulators. |
85
-
|**Support period**| Art. 13(2), 13(8) | Minimum duration during which the manufacturer must provide **free security updates**. Default: at least **5 years** (or the product's expected lifetime if longer). Must be declared in the technical documentation. |
86
-
|**ENISA**| Art. 14 | EU Agency for Cybersecurity. Recipient of the **24-hour** early-warning report when a vulnerability in your product is **actively exploited**, plus 72-hour update and 14-day final report. |
85
+
|**Support period**| Art. 13(2), 13(8) | Minimum duration during which the manufacturer must provide **free security updates**. Default: at least **5 years**, unless the product is expected to be in use for a shorter period (and longer where the expected lifetime is longer). Must be declared in the technical documentation. |
86
+
|**ENISA**| Art. 14, 16 | EU Agency for Cybersecurity. Operates the **Single Reporting Platform (SRP)**; manufacturers file through it and reports reach the **coordinator CSIRT** with ENISA notified **simultaneously** — the **24-hour** early-warning when a vulnerability is **actively exploited**, plus 72-hour update and 14-day final report. |
87
+
|**SRP** (Single Reporting Platform) | Art. 16 | ENISA-operated platform (live **11 Sep 2026**) where manufacturers file Art. 14 reports once; routes to the coordinator CSIRT + ENISA and on to affected Member States. |
88
+
|**CSIRT** (designated as coordinator) | Art. 14(7) | National incident-response team that receives your Art. 14 report via the SRP and disseminates it. Determined by your EU main establishment — or, for non-EU manufacturers, your **Authorised Representative's** Member State. |
89
+
|**EUVD** (European Vulnerability Database) | Art. 16(2) / NIS2 | ENISA's public database where **fixed** vulnerabilities reported via the SRP are published; makes disclosure timelines verifiable. |
87
90
|**CNA**| (CVE programme) |**CVE Numbering Authority** — organisation authorised to assign CVE IDs within its scope. wolfSSL is a CNA for wolfSSL libraries. |
88
91
89
92
For execution detail on these obligations, see [`CRA-Compliance-Shortlist.md`](CRA-Compliance-Shortlist.md) "Beyond this kit (structural CRA obligations)".
-**bomsh** = optional provenance; not required for most CRA transparency asks.
97
-
-**Vulnerability handling (Art. 13/14)** = customer publishes their own CVD policy + `security.txt`, runs on-call, files 24h ENISA reports for their product; wolfSSL provides reference templates and handles ENISA reporting only for libraries placed on the EU market by wolfSSL Inc.
97
+
-**Vulnerability handling (Art. 13/14/16)** = customer publishes their own CVD policy + `security.txt`, runs on-call, files 24h reports via the **Single Reporting Platform** (to their coordinator CSIRT + ENISA) for their product; wolfSSL provides reference templates and handles reporting only for libraries placed on the EU market by wolfSSL Inc.
98
98
-**Structural CRA (out of scope for this kit)** = EU Authorised Representative (Art. 18 — required if customer is outside the EU), Annex III/IV classification (determines self-cert vs Notified Body), conformity assessment + CE mark (Art. 32, 30), technical documentation (Annex VII), support-period commitment (Art. 13(8), 5+ years default). When a customer asks "are we ready?", surface these — SBOMs alone are not enough. Recommend engaging CRA counsel or consultant.
Copy file name to clipboardExpand all lines: cra-kit/auditor-packet/wolfssl-component/wolfssl-5.9.1.cbom-draft.cdx.json
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -27,7 +27,7 @@
27
27
"properties": [
28
28
{
29
29
"name": "wolfssl:cbom:status",
30
-
"value": "DRAFT — illustrative starter set for the CycloneDX 1.6 cryptographic-asset profile. Derived from the build configuration in wolfssl-5.9.1.cdx.json (HAVE_AESGCM, HAVE_CHACHA, HAVE_POLY1305, HAVE_ECC, HAVE_HKDF, WOLFSSL_SHA256/384/512, WOLFSSL_TLS13, WOLFSSL_HAVE_MLKEM). Not exhaustive. See ROADMAP.md."
30
+
"value": "DRAFT — illustrative starter set for the CycloneDX 1.6 cryptographic-asset profile. Derived from the build configuration in wolfssl-5.9.1.cdx.json (HAVE_AESGCM, HAVE_CHACHA, HAVE_POLY1305, HAVE_ECC, HAVE_HKDF, WOLFSSL_SHA256/384/512, WOLFSSL_TLS13, WOLFSSL_HAVE_MLKEM). Not exhaustive."
Copy file name to clipboardExpand all lines: cra-kit/presentations/SLIDE-OUTLINE.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,7 +16,7 @@ Use **[`CRA-Compliance-Shortlist.md`](../CRA-Compliance-Shortlist.md)** — two
16
16
|**Know your software components**| Survey all integrated components: who maintains them? how do you track vulns/releases? | SBOMs for our products; continuous vulnerability management and updates |
17
17
|**Implement secure boot**| Most influential action today: trusted firmware + update path aligned with complaint/timing rules |**wolfBoot**|
18
18
|**Remote data processing / data in transfer**| CRA covers data between device and network — use current crypto and secure protocols |**TLS**, **SSH**, **MQTTS**, … |
19
-
|**Vulnerability handling & reporting**| Published CVD policy + `security.txt`; 24h ENISA reporting (Art. 14); on-call coverage — process, not a deliverable | wolfSSL [`security.txt`](https://www.wolfssl.com/.well-known/security.txt) + [CVD policy](https://www.wolfssl.com/.well-known/vulnerability-disclosure-policy.txt) as reference templates; advisories; CNA |
19
+
|**Vulnerability handling & reporting**| Published CVD policy + `security.txt`; 24h reporting via the **SRP** (to coordinator CSIRT + ENISA, Art. 14/16); on-call coverage — process, not a deliverable | wolfSSL [`security.txt`](https://www.wolfssl.com/.well-known/security.txt) + [CVD policy](https://www.wolfssl.com/.well-known/vulnerability-disclosure-policy.txt) as reference templates; advisories; CNA |
20
20
21
21
**Bridge to this session:** pillar 1 is where the **CRA Kit** lands (SBOM, auditor packet, scripts).
|[`vulnerability-handling-process.md`](vulnerability-handling-process.md)| Art. 13, 14| 🟡 Process documented; public SLA pending leadership approval|
10
+
|[`vulnerability-handling-process.md`](vulnerability-handling-process.md)| Art. 13, 14, 16 | ✅ Process documented; wolfSSL Inc. commits to Art. 13/14 compliance|
11
11
|[`technical-documentation-outline.md`](technical-documentation-outline.md)| Annex VII | 🟠 In progress — outline complete; per-release packet on roadmap |
12
12
|[`ce-marking-statement.md`](ce-marking-statement.md)| Art. 30 | 🟡 Will affix on first CRA-applicable release after 11 Dec 2027 |
0 commit comments