Every Annex I requirement, with the evidence behind it.
Annex I lists what every product must meet: security properties in Part I and vulnerability handling in Part II. Regulus takes you through each one, records how you meet it and keeps the evidence next to it.
Three steps, no calls.
- 01
Decide what applies
Each requirement applies unless the risk assessment justifies otherwise, and that justification is recorded.
- 02
Describe how you meet it
The measure, the standard you follow if any, and where the evidence lives.
- 03
Watch the score
Readiness counts only what you can show, so it is a fair picture of where the file stands.
Annex I requirements in Regulus.
Part I and Part II
Fourteen product requirements and eight for vulnerability handling, as listed in Annex I.
Linked to risks
Each threat in the risk assessment points to the requirement it affects.
Policies inherited
Disclosure, update and support policies written once apply to every product.
Straight into the file
The checklist document and the Annex VII technical documentation are built from these answers.
Read more about it.
Our guides on the Cyber Resilience Act, written against the adopted text.
Questions about annex i requirements.
What are the essential requirements of the CRA?
Annex I, Part I, sets the security properties of the product, such as secure by default configuration, protection from unauthorised access and security updates. Part II sets the vulnerability handling duties, such as keeping an SBOM and a coordinated disclosure policy.
Do all Annex I requirements apply to every product?
They apply on the basis of the cybersecurity risk assessment. Where a requirement is not applicable, the manufacturer has to justify it in the technical documentation.
Do harmonised standards for the CRA exist yet?
They are being drafted under the Commission's standardisation request. Until they are published, manufacturers show conformity against the requirements themselves.
One file, start to finish.
Scope. Check whether the Cyber Resilience Act applies to your product.
Classification. Classify your product under the Cyber Resilience Act by its core function.
Risk assessment. Build the cybersecurity risk assessment the Cyber Resilience Act requires.
Technical file. Generate the Cyber Resilience Act technical file in editable Word.
Article 14 reporting. Meet the Cyber Resilience Act reporting obligations of Article 14.
Start with your own product.
Free for manufacturers. An expert is one click away when you want one.