FR-135 CRA 合規框架 · 已灌入框架、待顧問確認 · 2026-10-12
每條控制項的英文標題與該收什麼證據，灌進框架當控制項標題與建議證據（guidance）
法條只寫產品要做到什麼，沒寫怎麼證明。這份為 34 條各擬一個英文標題，並寫出建議證據：交什麼檔、檔裡要看到什麼、證據從哪來。沒拆評估目標（AO）的 18 條，建議證據掛在控制項；拆了 AO 的 16 條，建議證據掛在各 AO 底下（見 cra-assessment-objectives.md）。
docs/reference/CRA/）與 ENISA／JRC 對照報告（JRC137340，2024）的子要求；逐條對照見同資料夾 enisa-mapping-worksheet.md。不是官方清單，也不是調和標準；ENISA 與 EN 40000 的文字不抄進框架。Deliverable（交什麼檔或紀錄）、Must show（審閱者要在裡面看到什麼）、Evidence（upload 客戶自有檔上傳／system — <頁面> 系統其他頁填完就有、不該再上傳／template — <範本> 系統範本產出）。標 (Phase N) 的系統落點是之後才上線的功能，在那之前先上傳。scripts/cra_ao_content.py，再跑 python scripts/gen_cra_ao_restructure.py：本檔「建議證據」段（標記之間）、cra-assessment-objectives.md 與 jedi-oscal-v2 seed 005 一起重產。標題表不在產生範圍，改標題要同步改 002 seed。CRA.I.*／CRA.II.*／CRA.A2.*／CRA.ART.*（Annex II 用 A2，因為 CRA 的 Annex III 是重要產品清單，用 III 會誤讀）。Titles are self-drafted (the regulation has no item headings), following the CMMC title style: noun phrase, title case, at most 8 words. The basis column quotes the phrase each title is taken from.
| Control | Title | Basis (legal text) |
|---|---|---|
| CRA.I.1 | Risk-Based Cybersecurity by Design | Part I (1): "designed, developed and produced … an appropriate level of cybersecurity based on the risks" |
| CRA.I.2.a | No Known Exploitable Vulnerabilities | Part I (2)(a): "without known exploitable vulnerabilities" |
| CRA.I.2.b | Secure-by-Default Configuration & Reset | Part I (2)(b): "a secure by default configuration … including the possibility to reset the product to its original state" |
| CRA.I.2.c | Security Updates & Automatic Updating | Part I (2)(c): "addressed through security updates, including … automatic security updates" |
| CRA.I.2.d | Protection from Unauthorised Access | Part I (2)(d): "protection from unauthorised access by appropriate control mechanisms" |
| CRA.I.2.e | Data Confidentiality | Part I (2)(e): "protect the confidentiality of stored, transmitted or otherwise processed data" |
| CRA.I.2.f | Integrity of Data, Programs & Configuration | Part I (2)(f): "protect the integrity of … data … commands, programs and configuration" |
| CRA.I.2.g | Data Minimisation | Part I (2)(g): "limited to what is necessary … (data minimisation)" |
| CRA.I.2.h | Availability of Essential & Basic Functions | Part I (2)(h): "protect the availability of essential and basic functions, also after an incident" |
| CRA.I.2.i | Limiting Impact on Other Devices & Networks | Part I (2)(i): "minimise the negative impact … on the availability of services provided by other devices or networks" |
| CRA.I.2.j | Attack Surface Limitation | Part I (2)(j): "limit attack surfaces, including external interfaces" |
| CRA.I.2.k | Exploitation Mitigation & Incident Impact Reduction | Part I (2)(k): "reduce the impact of an incident using appropriate exploitation mitigation mechanisms" |
| CRA.I.2.l | Recording & Monitoring of Internal Activity | Part I (2)(l): "recording and monitoring relevant internal activity" |
| CRA.I.2.m | Secure Data Removal & Transfer | Part I (2)(m): "securely and easily remove on a permanent basis all data and settings … transferred … in a secure manner" |
| CRA.II.1 | Vulnerability & Component Identification (SBOM) | Part II (1): "identify and document vulnerabilities and components … software bill of materials" |
| CRA.II.2 | Timely Vulnerability Remediation | Part II (2): "address and remediate vulnerabilities without delay" |
| CRA.II.3 | Regular Security Testing & Review | Part II (3): "effective and regular tests and reviews of the security" |
| CRA.II.4 | Public Disclosure of Fixed Vulnerabilities | Part II (4): "share and publicly disclose information about fixed vulnerabilities" |
| CRA.II.5 | Coordinated Vulnerability Disclosure Policy | Part II (5): "a policy on coordinated vulnerability disclosure" |
| CRA.II.6 | Vulnerability Information Sharing & Reporting Contact | Part II (6): "facilitate the sharing of information about potential vulnerabilities … providing a contact address" |
| CRA.II.7 | Secure Update Distribution | Part II (7): "mechanisms to securely distribute updates" |
| CRA.II.8 | Timely, Free Security Updates with Advisories | Part II (8): "disseminated without delay and … free of charge, accompanied by advisory messages" |
| CRA.A2.1 | Manufacturer Identity & Contact Details | Annex II (1): "the name … of the manufacturer, and the postal address, the email address or other digital contact" |
| CRA.A2.2 | Vulnerability Reporting Contact & CVD Policy | Annex II (2): "the single point of contact … and where the manufacturer's policy on coordinated vulnerability disclosure can be found" |
| CRA.A2.3 | Product Identification | Annex II (3): "name and type and any additional information enabling the unique identification" |
| CRA.A2.4 | Intended Purpose & Security Properties | Annex II (4): "the intended purpose … essential functionalities and information about the security properties" |
| CRA.A2.5 | Foreseeable Significant Cybersecurity Risks | Annex II (5): "known or foreseeable circumstance … which may lead to significant cybersecurity risks" |
| CRA.A2.6 | EU Declaration of Conformity Address | Annex II (6): "the internet address at which the EU declaration of conformity can be accessed" |
| CRA.A2.7 | Security Support Type & End Date | Annex II (7): "the type of technical security support … and the end-date of the support period" |
| CRA.A2.8 | Detailed Secure-Use Instructions | Annex II (8): "detailed instructions … and information on" items (a)–(f) |
| CRA.A2.9 | SBOM Access Information | Annex II (9): "information on where the software bill of materials can be accessed" |
| CRA.ART.13.RA | Cybersecurity Risk Assessment | Art. 13(2)(3): "an assessment of the cybersecurity risks" |
| CRA.ART.13.SP | Support Period | Art. 13(8): "the support period shall be at least five years" |
| CRA.ART.14.RP | Reporting of Exploited Vulnerabilities and Severe Incidents | Art. 14(1)(3): "notify any actively exploited vulnerability … any severe incident" |
See assessment objectives [a]–[b]. 各 AO 的建議證據見 cra-assessment-objectives.md。
See assessment objectives [a]–[c]. 各 AO 的建議證據見 cra-assessment-objectives.md。
See assessment objectives [a]–[e]. 各 AO 的建議證據見 cra-assessment-objectives.md。
See assessment objectives [a]–[c]. 各 AO 的建議證據見 cra-assessment-objectives.md。
See assessment objectives [a]–[b]. 各 AO 的建議證據見 cra-assessment-objectives.md。
See assessment objectives [a]–[b]. 各 AO 的建議證據見 cra-assessment-objectives.md。
See assessment objectives [a]–[d]. 各 AO 的建議證據見 cra-assessment-objectives.md。
See assessment objectives [a]–[b]. 各 AO 的建議證據見 cra-assessment-objectives.md。
See assessment objectives [a]–[b]. 各 AO 的建議證據見 cra-assessment-objectives.md。
See assessment objectives [a]–[c]. 各 AO 的建議證據見 cra-assessment-objectives.md。
See assessment objectives [a]–[c]. 各 AO 的建議證據見 cra-assessment-objectives.md。
See assessment objectives [a]–[c]. 各 AO 的建議證據見 cra-assessment-objectives.md。
See assessment objectives [a]–[f]. 各 AO 的建議證據見 cra-assessment-objectives.md。
See assessment objectives [a]–[c]. 各 AO 的建議證據見 cra-assessment-objectives.md。
See assessment objectives [a]–[c]. 各 AO 的建議證據見 cra-assessment-objectives.md。
See assessment objectives [a]–[c]. 各 AO 的建議證據見 cra-assessment-objectives.md。
只給審稿人用，不灌進框架。