{
  "name": "CRA vendor register",
  "description": "What 13 CRA tools document on their own public pages for each of the 22 essential cybersecurity requirements of Annex I of Regulation (EU) 2024/2847, with a quoted source and the date of the check.",
  "url": "https://cradata.eu/register",
  "publisher": "CVD Portal, Porta Regulus B.V.",
  "license": "CC BY 4.0",
  "licenseUrl": "https://creativecommons.org/licenses/by/4.0/",
  "version": "1.0.0",
  "lastVerified": "2026-10-01",
  "catalogueVersion": "1.0.0",
  "disputeContact": "research@portaregulus.com",
  "citation": "CVD Portal, \"CRA vendor register\", 2026-10-01. https://cradata.eu/register (CC BY 4.0)",
  "vendors": [
    {
      "slug": "anchore",
      "name": "Anchore",
      "domains": [
        "anchore.com"
      ]
    },
    {
      "slug": "armorcode",
      "name": "ArmorCode",
      "domains": [
        "armorcode.com"
      ]
    },
    {
      "slug": "cetome-crated",
      "name": "CETome CRAted",
      "domains": [
        "cetome.com"
      ]
    },
    {
      "slug": "cra-evidence-platform",
      "name": "CRA Evidence Platform",
      "domains": [
        "craevidence.com"
      ]
    },
    {
      "slug": "cvdportal",
      "name": "CVD Portal",
      "domains": [
        "cvdportal.com"
      ]
    },
    {
      "slug": "cycode",
      "name": "Cycode",
      "domains": [
        "cycode.com"
      ]
    },
    {
      "slug": "drata",
      "name": "Drata",
      "domains": [
        "drata.com"
      ]
    },
    {
      "slug": "hackerone",
      "name": "HackerOne",
      "domains": [
        "hackerone.com"
      ]
    },
    {
      "slug": "ketryx",
      "name": "Ketryx",
      "domains": [
        "ketryx.com"
      ]
    },
    {
      "slug": "kunnus",
      "name": "Kunnus",
      "domains": [
        "kunnus.tech"
      ]
    },
    {
      "slug": "onekey",
      "name": "ONEKEY",
      "domains": [
        "onekey.com"
      ]
    },
    {
      "slug": "vanta",
      "name": "Vanta",
      "domains": [
        "vanta.com"
      ]
    },
    {
      "slug": "venvera",
      "name": "Venvera",
      "domains": [
        "venvera.com"
      ]
    }
  ],
  "claims": [
    {
      "vendor": "anchore",
      "requirement": "I-1",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://docs.anchore.com/current/docs/quickstarts/eucra/",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "Annex I",
        "essential cybersecurity requirements",
        "essential requirements"
      ]
    },
    {
      "vendor": "anchore",
      "requirement": "I-2a",
      "value": "documented",
      "kinds": [
        "verifies"
      ],
      "sourceUrl": "https://docs.anchore.com/current/docs/quickstarts/eucra/",
      "accessed": "2026-10-01",
      "snippet": "each of which returns STOP when a finding is listed on the CISA KEV catalog",
      "specific": true
    },
    {
      "vendor": "anchore",
      "requirement": "I-2b",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://docs.anchore.com/current/docs/quickstarts/eucra/",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "secure by default",
        "secure-by-default",
        "default configuration"
      ]
    },
    {
      "vendor": "anchore",
      "requirement": "I-2c",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://docs.anchore.com/current/docs/quickstarts/eucra/",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "security update",
        "OTA",
        "patch management"
      ]
    },
    {
      "vendor": "anchore",
      "requirement": "I-2d",
      "value": "documented",
      "kinds": [
        "verifies"
      ],
      "sourceUrl": "https://docs.anchore.com/current/docs/compliance_management/policies/gates/secret_scans/",
      "accessed": "2026-10-01",
      "snippet": "allows users to perform checks against secrets and content found in an image SBOM",
      "specific": true
    },
    {
      "vendor": "anchore",
      "requirement": "I-2e",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://docs.anchore.com/current/docs/quickstarts/eucra/",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "encryption",
        "confidentiality"
      ]
    },
    {
      "vendor": "anchore",
      "requirement": "I-2f",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://docs.anchore.com/current/docs/quickstarts/eucra/",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "integrity",
        "tamper",
        "code signing"
      ]
    },
    {
      "vendor": "anchore",
      "requirement": "I-2g",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://docs.anchore.com/current/docs/quickstarts/eucra/",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "data minimi",
        "personal data"
      ]
    },
    {
      "vendor": "anchore",
      "requirement": "I-2h",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://docs.anchore.com/current/docs/quickstarts/eucra/",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "availability",
        "denial of service",
        "denial-of-service"
      ]
    },
    {
      "vendor": "anchore",
      "requirement": "I-2i",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://docs.anchore.com/current/docs/quickstarts/eucra/",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "other devices",
        "network impact"
      ]
    },
    {
      "vendor": "anchore",
      "requirement": "I-2j",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://docs.anchore.com/current/docs/quickstarts/eucra/",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "attack surface",
        "external interfaces",
        "open ports"
      ]
    },
    {
      "vendor": "anchore",
      "requirement": "I-2k",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://docs.anchore.com/current/docs/quickstarts/eucra/",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "exploit mitigation",
        "exploitation mitigation",
        "impact of an incident"
      ]
    },
    {
      "vendor": "anchore",
      "requirement": "I-2l",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://docs.anchore.com/current/docs/quickstarts/eucra/",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "logging",
        "audit log",
        "security monitoring"
      ]
    },
    {
      "vendor": "anchore",
      "requirement": "I-2m",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://docs.anchore.com/current/docs/quickstarts/eucra/",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "data deletion",
        "delete all data",
        "data portability"
      ]
    },
    {
      "vendor": "anchore",
      "requirement": "II-1",
      "value": "documented",
      "kinds": [
        "produces"
      ],
      "sourceUrl": "https://docs.anchore.com/current/docs/quickstarts/eucra/",
      "accessed": "2026-10-01",
      "snippet": "export the unified SBOM as CycloneDX 1.6 or SPDX 2.3",
      "specific": true
    },
    {
      "vendor": "anchore",
      "requirement": "II-2",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.anchore.com/current/docs/quickstarts/eucra/",
      "accessed": "2026-10-01",
      "snippet": "Document your engineering analysis as vulnerability annotations using the standard VEX status and justification vocabulary.",
      "specific": true
    },
    {
      "vendor": "anchore",
      "requirement": "II-3",
      "value": "documented",
      "kinds": [
        "verifies"
      ],
      "sourceUrl": "https://docs.anchore.com/current/docs/quickstarts/eucra/",
      "accessed": "2026-10-01",
      "snippet": "continuous policy evaluation constitutes the regular testing and review Annex I Part II (3)",
      "specific": true
    },
    {
      "vendor": "anchore",
      "requirement": "II-4",
      "value": "documented",
      "kinds": [
        "produces"
      ],
      "sourceUrl": "https://docs.anchore.com/current/docs/quickstarts/eucra/",
      "accessed": "2026-10-01",
      "snippet": "For the public advisory obligation (Annex I Part II (4)), export the VEX document",
      "specific": true
    },
    {
      "vendor": "anchore",
      "requirement": "II-5",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://docs.anchore.com/current/docs/quickstarts/eucra/",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "coordinated vulnerability disclosure",
        "CVD",
        "disclosure policy"
      ]
    },
    {
      "vendor": "anchore",
      "requirement": "II-6",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://docs.anchore.com/current/docs/quickstarts/eucra/",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "security.txt",
        "report a vulnerability",
        "reporting channel"
      ]
    },
    {
      "vendor": "anchore",
      "requirement": "II-7",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://docs.anchore.com/current/docs/quickstarts/eucra/",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "update distribution",
        "signed update",
        "secure delivery"
      ]
    },
    {
      "vendor": "anchore",
      "requirement": "II-8",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.anchore.com/current/docs/quickstarts/eucra/",
      "accessed": "2026-10-01",
      "snippet": "Model the security update as a new linked version containing the fixed components",
      "specific": true
    },
    {
      "vendor": "armorcode",
      "requirement": "I-1",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.armorcode.com/cyber-resilience-act-compliance",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "Annex I",
        "essential cybersecurity requirements",
        "essential requirements"
      ]
    },
    {
      "vendor": "armorcode",
      "requirement": "I-2a",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.armorcode.com/cyber-resilience-act-compliance",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "known exploitable vulnerabilit",
        "exploitable vulnerabilit",
        "vulnerability scan"
      ]
    },
    {
      "vendor": "armorcode",
      "requirement": "I-2b",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.armorcode.com/cyber-resilience-act-compliance",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "secure by default",
        "secure-by-default",
        "default configuration"
      ]
    },
    {
      "vendor": "armorcode",
      "requirement": "I-2c",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.armorcode.com/cyber-resilience-act-compliance",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "security update",
        "OTA",
        "patch management"
      ]
    },
    {
      "vendor": "armorcode",
      "requirement": "I-2d",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.armorcode.com/cyber-resilience-act-compliance",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "access control",
        "authentication",
        "unauthorised access"
      ]
    },
    {
      "vendor": "armorcode",
      "requirement": "I-2e",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.armorcode.com/cyber-resilience-act-compliance",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "encryption",
        "confidentiality"
      ]
    },
    {
      "vendor": "armorcode",
      "requirement": "I-2f",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.armorcode.com/cyber-resilience-act-compliance",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "integrity",
        "tamper",
        "code signing"
      ]
    },
    {
      "vendor": "armorcode",
      "requirement": "I-2g",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.armorcode.com/cyber-resilience-act-compliance",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "data minimi",
        "personal data"
      ]
    },
    {
      "vendor": "armorcode",
      "requirement": "I-2h",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.armorcode.com/cyber-resilience-act-compliance",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "availability",
        "denial of service",
        "denial-of-service"
      ]
    },
    {
      "vendor": "armorcode",
      "requirement": "I-2i",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.armorcode.com/cyber-resilience-act-compliance",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "other devices",
        "network impact"
      ]
    },
    {
      "vendor": "armorcode",
      "requirement": "I-2j",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.armorcode.com/cyber-resilience-act-compliance",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "attack surface",
        "external interfaces",
        "open ports"
      ]
    },
    {
      "vendor": "armorcode",
      "requirement": "I-2k",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.armorcode.com/cyber-resilience-act-compliance",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "exploit mitigation",
        "exploitation mitigation",
        "impact of an incident"
      ]
    },
    {
      "vendor": "armorcode",
      "requirement": "I-2l",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.armorcode.com/cyber-resilience-act-compliance",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "logging",
        "audit log",
        "security monitoring"
      ]
    },
    {
      "vendor": "armorcode",
      "requirement": "I-2m",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.armorcode.com/cyber-resilience-act-compliance",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "data deletion",
        "delete all data",
        "data portability"
      ]
    },
    {
      "vendor": "armorcode",
      "requirement": "II-1",
      "value": "documented",
      "kinds": [
        "produces"
      ],
      "sourceUrl": "https://www.armorcode.com/cyber-resilience-act-compliance",
      "accessed": "2026-10-01",
      "snippet": "Generate and share tamper-resistant SBOM and VEX disclosures from a single platform.",
      "specific": true
    },
    {
      "vendor": "armorcode",
      "requirement": "II-2",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://www.armorcode.com/cyber-resilience-act-compliance",
      "accessed": "2026-10-01",
      "snippet": "Leverage Anya, ArmorCode’s agentic AI framework, to speed CRA readiness and vulnerability remediation.",
      "specific": true
    },
    {
      "vendor": "armorcode",
      "requirement": "II-3",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.armorcode.com/cyber-resilience-act-compliance",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "security testing",
        "penetration test",
        "pentest"
      ]
    },
    {
      "vendor": "armorcode",
      "requirement": "II-4",
      "value": "documented",
      "kinds": [
        "produces"
      ],
      "sourceUrl": "https://www.armorcode.com/feature-focus/eu-cyber-resilience-act-compliance",
      "accessed": "2026-10-01",
      "snippet": "Continuous SBOM and VEX in CycloneDX, refreshed from every release.",
      "specific": true
    },
    {
      "vendor": "armorcode",
      "requirement": "II-5",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.armorcode.com/cyber-resilience-act-compliance",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "coordinated vulnerability disclosure",
        "CVD",
        "disclosure policy"
      ]
    },
    {
      "vendor": "armorcode",
      "requirement": "II-6",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.armorcode.com/cyber-resilience-act-compliance",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "security.txt",
        "report a vulnerability",
        "reporting channel"
      ]
    },
    {
      "vendor": "armorcode",
      "requirement": "II-7",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.armorcode.com/cyber-resilience-act-compliance",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "update distribution",
        "signed update",
        "secure delivery"
      ]
    },
    {
      "vendor": "armorcode",
      "requirement": "II-8",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.armorcode.com/cyber-resilience-act-compliance",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "security patch",
        "free of charge",
        "without delay"
      ]
    },
    {
      "vendor": "cetome-crated",
      "requirement": "I-1",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://crated.cetome.com/",
      "accessed": "2026-10-01",
      "snippet": "Answer the Annex I requirements through simple verification questions, with evidence",
      "specific": false
    },
    {
      "vendor": "cetome-crated",
      "requirement": "I-2a",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://crated.cetome.com/",
      "accessed": "2026-10-01",
      "snippet": "Answer the Annex I requirements through simple verification questions, with evidence",
      "specific": false
    },
    {
      "vendor": "cetome-crated",
      "requirement": "I-2b",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://crated.cetome.com/",
      "accessed": "2026-10-01",
      "snippet": "Answer the Annex I requirements through simple verification questions, with evidence",
      "specific": false
    },
    {
      "vendor": "cetome-crated",
      "requirement": "I-2c",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://crated.cetome.com/",
      "accessed": "2026-10-01",
      "snippet": "Answer the Annex I requirements through simple verification questions, with evidence",
      "specific": false
    },
    {
      "vendor": "cetome-crated",
      "requirement": "I-2d",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://crated.cetome.com/",
      "accessed": "2026-10-01",
      "snippet": "Answer the Annex I requirements through simple verification questions, with evidence",
      "specific": false
    },
    {
      "vendor": "cetome-crated",
      "requirement": "I-2e",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://crated.cetome.com/",
      "accessed": "2026-10-01",
      "snippet": "Answer the Annex I requirements through simple verification questions, with evidence",
      "specific": false
    },
    {
      "vendor": "cetome-crated",
      "requirement": "I-2f",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://crated.cetome.com/",
      "accessed": "2026-10-01",
      "snippet": "Answer the Annex I requirements through simple verification questions, with evidence",
      "specific": false
    },
    {
      "vendor": "cetome-crated",
      "requirement": "I-2g",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://crated.cetome.com/",
      "accessed": "2026-10-01",
      "snippet": "Answer the Annex I requirements through simple verification questions, with evidence",
      "specific": false
    },
    {
      "vendor": "cetome-crated",
      "requirement": "I-2h",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://crated.cetome.com/",
      "accessed": "2026-10-01",
      "snippet": "Answer the Annex I requirements through simple verification questions, with evidence",
      "specific": false
    },
    {
      "vendor": "cetome-crated",
      "requirement": "I-2i",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://crated.cetome.com/",
      "accessed": "2026-10-01",
      "snippet": "Answer the Annex I requirements through simple verification questions, with evidence",
      "specific": false
    },
    {
      "vendor": "cetome-crated",
      "requirement": "I-2j",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://crated.cetome.com/",
      "accessed": "2026-10-01",
      "snippet": "Answer the Annex I requirements through simple verification questions, with evidence",
      "specific": false
    },
    {
      "vendor": "cetome-crated",
      "requirement": "I-2k",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://crated.cetome.com/",
      "accessed": "2026-10-01",
      "snippet": "Answer the Annex I requirements through simple verification questions, with evidence",
      "specific": false
    },
    {
      "vendor": "cetome-crated",
      "requirement": "I-2l",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://crated.cetome.com/",
      "accessed": "2026-10-01",
      "snippet": "Answer the Annex I requirements through simple verification questions, with evidence",
      "specific": false
    },
    {
      "vendor": "cetome-crated",
      "requirement": "I-2m",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://crated.cetome.com/",
      "accessed": "2026-10-01",
      "snippet": "Answer the Annex I requirements through simple verification questions, with evidence",
      "specific": false
    },
    {
      "vendor": "cetome-crated",
      "requirement": "II-1",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://crated.cetome.com/",
      "accessed": "2026-10-01",
      "snippet": "Answer the Annex I requirements through simple verification questions, with evidence",
      "specific": false
    },
    {
      "vendor": "cetome-crated",
      "requirement": "II-2",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://crated.cetome.com/",
      "accessed": "2026-10-01",
      "snippet": "Answer the Annex I requirements through simple verification questions, with evidence",
      "specific": false
    },
    {
      "vendor": "cetome-crated",
      "requirement": "II-3",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://crated.cetome.com/",
      "accessed": "2026-10-01",
      "snippet": "Answer the Annex I requirements through simple verification questions, with evidence",
      "specific": false
    },
    {
      "vendor": "cetome-crated",
      "requirement": "II-4",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://crated.cetome.com/",
      "accessed": "2026-10-01",
      "snippet": "Answer the Annex I requirements through simple verification questions, with evidence",
      "specific": false
    },
    {
      "vendor": "cetome-crated",
      "requirement": "II-5",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://crated.cetome.com/",
      "accessed": "2026-10-01",
      "snippet": "Answer the Annex I requirements through simple verification questions, with evidence",
      "specific": false
    },
    {
      "vendor": "cetome-crated",
      "requirement": "II-6",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://crated.cetome.com/",
      "accessed": "2026-10-01",
      "snippet": "Answer the Annex I requirements through simple verification questions, with evidence",
      "specific": false
    },
    {
      "vendor": "cetome-crated",
      "requirement": "II-7",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://crated.cetome.com/",
      "accessed": "2026-10-01",
      "snippet": "Answer the Annex I requirements through simple verification questions, with evidence",
      "specific": false
    },
    {
      "vendor": "cetome-crated",
      "requirement": "II-8",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://crated.cetome.com/",
      "accessed": "2026-10-01",
      "snippet": "Answer the Annex I requirements through simple verification questions, with evidence",
      "specific": false
    },
    {
      "vendor": "cra-evidence-platform",
      "requirement": "I-1",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://craevidence.com/",
      "accessed": "2026-10-01",
      "snippet": "Generate your EU Declaration of Conformity, risk assessment, and technical file for every release",
      "specific": true
    },
    {
      "vendor": "cra-evidence-platform",
      "requirement": "I-2a",
      "value": "documented",
      "kinds": [
        "verifies"
      ],
      "sourceUrl": "https://craevidence.com/",
      "accessed": "2026-10-01",
      "snippet": "Automated Vulnerability Scanning Scan SBOMs against our Vulnerability Knowledge Base",
      "specific": true
    },
    {
      "vendor": "cra-evidence-platform",
      "requirement": "I-2b",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://craevidence.com/",
      "accessed": "2026-10-01",
      "snippet": "Score your product against CRA Annex I security requirements.",
      "specific": false
    },
    {
      "vendor": "cra-evidence-platform",
      "requirement": "I-2c",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://craevidence.com/",
      "accessed": "2026-10-01",
      "snippet": "Score your product against CRA Annex I security requirements.",
      "specific": false
    },
    {
      "vendor": "cra-evidence-platform",
      "requirement": "I-2d",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://craevidence.com/",
      "accessed": "2026-10-01",
      "snippet": "Score your product against CRA Annex I security requirements.",
      "specific": false
    },
    {
      "vendor": "cra-evidence-platform",
      "requirement": "I-2e",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://craevidence.com/",
      "accessed": "2026-10-01",
      "snippet": "Score your product against CRA Annex I security requirements.",
      "specific": false
    },
    {
      "vendor": "cra-evidence-platform",
      "requirement": "I-2f",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://craevidence.com/",
      "accessed": "2026-10-01",
      "snippet": "Score your product against CRA Annex I security requirements.",
      "specific": false
    },
    {
      "vendor": "cra-evidence-platform",
      "requirement": "I-2g",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://craevidence.com/",
      "accessed": "2026-10-01",
      "snippet": "Score your product against CRA Annex I security requirements.",
      "specific": false
    },
    {
      "vendor": "cra-evidence-platform",
      "requirement": "I-2h",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://craevidence.com/",
      "accessed": "2026-10-01",
      "snippet": "Score your product against CRA Annex I security requirements.",
      "specific": false
    },
    {
      "vendor": "cra-evidence-platform",
      "requirement": "I-2i",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://craevidence.com/",
      "accessed": "2026-10-01",
      "snippet": "Score your product against CRA Annex I security requirements.",
      "specific": false
    },
    {
      "vendor": "cra-evidence-platform",
      "requirement": "I-2j",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://craevidence.com/",
      "accessed": "2026-10-01",
      "snippet": "Score your product against CRA Annex I security requirements.",
      "specific": false
    },
    {
      "vendor": "cra-evidence-platform",
      "requirement": "I-2k",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://craevidence.com/",
      "accessed": "2026-10-01",
      "snippet": "Score your product against CRA Annex I security requirements.",
      "specific": false
    },
    {
      "vendor": "cra-evidence-platform",
      "requirement": "I-2l",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://craevidence.com/",
      "accessed": "2026-10-01",
      "snippet": "Score your product against CRA Annex I security requirements.",
      "specific": false
    },
    {
      "vendor": "cra-evidence-platform",
      "requirement": "I-2m",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://craevidence.com/",
      "accessed": "2026-10-01",
      "snippet": "Score your product against CRA Annex I security requirements.",
      "specific": false
    },
    {
      "vendor": "cra-evidence-platform",
      "requirement": "II-1",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://craevidence.com/",
      "accessed": "2026-10-01",
      "snippet": "Automated SBOM Validation Upload and validate CycloneDX artifacts",
      "specific": true
    },
    {
      "vendor": "cra-evidence-platform",
      "requirement": "II-2",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://craevidence.com/",
      "accessed": "2026-10-01",
      "snippet": "Track remediation and ENISA reporting deadlines per version.",
      "specific": true
    },
    {
      "vendor": "cra-evidence-platform",
      "requirement": "II-3",
      "value": "documented",
      "kinds": [
        "verifies"
      ],
      "sourceUrl": "https://craevidence.com/platform",
      "accessed": "2026-10-01",
      "snippet": "Upload SBOMs, trigger scans, and gate releases from CI.",
      "specific": true
    },
    {
      "vendor": "cra-evidence-platform",
      "requirement": "II-4",
      "value": "documented",
      "kinds": [
        "produces"
      ],
      "sourceUrl": "https://craevidence.com/",
      "accessed": "2026-10-01",
      "snippet": "Generate VEX statements automatically, or author them yourself",
      "specific": true
    },
    {
      "vendor": "cra-evidence-platform",
      "requirement": "II-5",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://craevidence.com/",
      "accessed": "2026-10-01",
      "snippet": "Score your product against CRA Annex I security requirements.",
      "specific": false
    },
    {
      "vendor": "cra-evidence-platform",
      "requirement": "II-6",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://craevidence.com/",
      "accessed": "2026-10-01",
      "snippet": "Score your product against CRA Annex I security requirements.",
      "specific": false
    },
    {
      "vendor": "cra-evidence-platform",
      "requirement": "II-7",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://craevidence.com/",
      "accessed": "2026-10-01",
      "snippet": "Score your product against CRA Annex I security requirements.",
      "specific": false
    },
    {
      "vendor": "cra-evidence-platform",
      "requirement": "II-8",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://craevidence.com/",
      "accessed": "2026-10-01",
      "snippet": "Score your product against CRA Annex I security requirements.",
      "specific": false
    },
    {
      "vendor": "cvdportal",
      "requirement": "I-1",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.cvdportal.com/cvd/products-compliance-workspace",
      "accessed": "2026-10-01",
      "snippet": "A 22-requirement self-assessment covering the overarching Annex I Part I(1) requirement",
      "specific": true
    },
    {
      "vendor": "cvdportal",
      "requirement": "I-2a",
      "value": "documented",
      "kinds": [
        "verifies"
      ],
      "sourceUrl": "https://docs.cvdportal.com/cvd/products-compliance-workspace",
      "accessed": "2026-10-01",
      "snippet": "supply-chain scan finding a critical, high-severity or actively exploited (KEV) vulnerability in an SBOM",
      "specific": true
    },
    {
      "vendor": "cvdportal",
      "requirement": "I-2b",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.cvdportal.com/cvd/en-40000-1-2/clause-5-4-secure-by-default",
      "accessed": "2026-10-01",
      "snippet": "You can document secure default testing results, anti-rollback checks, and reset-mechanism validation",
      "specific": true
    },
    {
      "vendor": "cvdportal",
      "requirement": "I-2c",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.cvdportal.com/cvd/products-compliance-workspace",
      "accessed": "2026-10-01",
      "snippet": "for each row you record evidence, an owner, a due date, a sign-off",
      "specific": false
    },
    {
      "vendor": "cvdportal",
      "requirement": "I-2d",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.cvdportal.com/cvd/products-compliance-workspace",
      "accessed": "2026-10-01",
      "snippet": "for each row you record evidence, an owner, a due date, a sign-off",
      "specific": false
    },
    {
      "vendor": "cvdportal",
      "requirement": "I-2e",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.cvdportal.com/cvd/products-compliance-workspace",
      "accessed": "2026-10-01",
      "snippet": "for each row you record evidence, an owner, a due date, a sign-off",
      "specific": false
    },
    {
      "vendor": "cvdportal",
      "requirement": "I-2f",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.cvdportal.com/cvd/products-compliance-workspace",
      "accessed": "2026-10-01",
      "snippet": "for each row you record evidence, an owner, a due date, a sign-off",
      "specific": false
    },
    {
      "vendor": "cvdportal",
      "requirement": "I-2g",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.cvdportal.com/cvd/products-compliance-workspace",
      "accessed": "2026-10-01",
      "snippet": "for each row you record evidence, an owner, a due date, a sign-off",
      "specific": false
    },
    {
      "vendor": "cvdportal",
      "requirement": "I-2h",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.cvdportal.com/cvd/products-compliance-workspace",
      "accessed": "2026-10-01",
      "snippet": "for each row you record evidence, an owner, a due date, a sign-off",
      "specific": false
    },
    {
      "vendor": "cvdportal",
      "requirement": "I-2i",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.cvdportal.com/cvd/products-compliance-workspace",
      "accessed": "2026-10-01",
      "snippet": "for each row you record evidence, an owner, a due date, a sign-off",
      "specific": false
    },
    {
      "vendor": "cvdportal",
      "requirement": "I-2j",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.cvdportal.com/cvd/products-compliance-workspace",
      "accessed": "2026-10-01",
      "snippet": "for each row you record evidence, an owner, a due date, a sign-off",
      "specific": false
    },
    {
      "vendor": "cvdportal",
      "requirement": "I-2k",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.cvdportal.com/cvd/products-compliance-workspace",
      "accessed": "2026-10-01",
      "snippet": "for each row you record evidence, an owner, a due date, a sign-off",
      "specific": false
    },
    {
      "vendor": "cvdportal",
      "requirement": "I-2l",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.cvdportal.com/cvd/products-compliance-workspace",
      "accessed": "2026-10-01",
      "snippet": "for each row you record evidence, an owner, a due date, a sign-off",
      "specific": false
    },
    {
      "vendor": "cvdportal",
      "requirement": "I-2m",
      "value": "documented",
      "kinds": [
        "drafts"
      ],
      "sourceUrl": "https://docs.cvdportal.com/cvd/en-40000-1-2/clause-7-9-decommissioning",
      "accessed": "2026-10-01",
      "snippet": "Policy library provides standardized user instructions for factory resets, data export, and secure disposal.",
      "specific": true
    },
    {
      "vendor": "cvdportal",
      "requirement": "II-1",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.cvdportal.com/cvd/features",
      "accessed": "2026-10-01",
      "snippet": "Store software bills of materials at Settings → SBOM",
      "specific": true
    },
    {
      "vendor": "cvdportal",
      "requirement": "II-2",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.cvdportal.com/cvd/remediation-decisions",
      "accessed": "2026-10-01",
      "snippet": "formally record their chosen remediation strategy for every validated vulnerability",
      "specific": true
    },
    {
      "vendor": "cvdportal",
      "requirement": "II-3",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.cvdportal.com/cvd/products-compliance-workspace",
      "accessed": "2026-10-01",
      "snippet": "for each row you record evidence, an owner, a due date, a sign-off",
      "specific": false
    },
    {
      "vendor": "cvdportal",
      "requirement": "II-4",
      "value": "documented",
      "kinds": [
        "produces"
      ],
      "sourceUrl": "https://docs.cvdportal.com/cvd/features",
      "accessed": "2026-10-01",
      "snippet": "Export advisories in CSAF (Common Security Advisory Framework) format from a submission",
      "specific": true
    },
    {
      "vendor": "cvdportal",
      "requirement": "II-5",
      "value": "documented",
      "kinds": [
        "operates"
      ],
      "sourceUrl": "https://docs.cvdportal.com/cvd/quick-start",
      "accessed": "2026-10-01",
      "snippet": "It gives your company a branded, public vulnerability disclosure portal",
      "specific": true
    },
    {
      "vendor": "cvdportal",
      "requirement": "II-6",
      "value": "documented",
      "kinds": [
        "produces",
        "operates"
      ],
      "sourceUrl": "https://docs.cvdportal.com/cvd/security-txt",
      "accessed": "2026-10-01",
      "snippet": "Your portal publishes a valid RFC 9116 file at https://<your-slug>.cvdportal.com/.well-known/security.txt with no setup",
      "specific": true
    },
    {
      "vendor": "cvdportal",
      "requirement": "II-7",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.cvdportal.com/cvd/en-40000-1-2/clause-7-7-production-and-distribution",
      "accessed": "2026-10-01",
      "snippet": "CVD Portal supports recording cryptographic hashes (SHA-256) and PGP signatures for published software update packages.",
      "specific": true
    },
    {
      "vendor": "cvdportal",
      "requirement": "II-8",
      "value": "documented",
      "kinds": [
        "records",
        "operates"
      ],
      "sourceUrl": "https://docs.cvdportal.com/cvd/user-advisory",
      "accessed": "2026-10-01",
      "snippet": "drafting, reviewing, and publishing comprehensive security advisories that meet the transparency requirements",
      "specific": true
    },
    {
      "vendor": "cycode",
      "requirement": "I-1",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://cycode.com/platform/",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "Annex I",
        "essential cybersecurity requirements",
        "essential requirements"
      ]
    },
    {
      "vendor": "cycode",
      "requirement": "I-2a",
      "value": "documented",
      "kinds": [
        "verifies"
      ],
      "sourceUrl": "https://cycode.com/sca-software-composition-analysis/",
      "accessed": "2026-10-01",
      "snippet": "With enterprise SCA tools from Cycode, you can prioritize exploitable vulnerabilities",
      "specific": true
    },
    {
      "vendor": "cycode",
      "requirement": "I-2b",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://cycode.com/platform/",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "secure by default",
        "secure-by-default",
        "default configuration"
      ]
    },
    {
      "vendor": "cycode",
      "requirement": "I-2c",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://cycode.com/platform/",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "security update",
        "OTA",
        "patch management"
      ]
    },
    {
      "vendor": "cycode",
      "requirement": "I-2d",
      "value": "documented",
      "kinds": [
        "verifies"
      ],
      "sourceUrl": "https://cycode.com/hard-coded-secrets-detection/",
      "accessed": "2026-10-01",
      "snippet": "Identify secrets across the SDLC",
      "specific": true
    },
    {
      "vendor": "cycode",
      "requirement": "I-2e",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://cycode.com/platform/",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "encryption",
        "confidentiality"
      ]
    },
    {
      "vendor": "cycode",
      "requirement": "I-2f",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://cycode.com/platform/",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "integrity",
        "tamper",
        "code signing"
      ]
    },
    {
      "vendor": "cycode",
      "requirement": "I-2g",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://cycode.com/platform/",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "data minimi",
        "personal data"
      ]
    },
    {
      "vendor": "cycode",
      "requirement": "I-2h",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://cycode.com/platform/",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "availability",
        "denial of service",
        "denial-of-service"
      ]
    },
    {
      "vendor": "cycode",
      "requirement": "I-2i",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://cycode.com/platform/",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "other devices",
        "network impact"
      ]
    },
    {
      "vendor": "cycode",
      "requirement": "I-2j",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://cycode.com/platform/",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "attack surface",
        "external interfaces",
        "open ports"
      ]
    },
    {
      "vendor": "cycode",
      "requirement": "I-2k",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://cycode.com/platform/",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "exploit mitigation",
        "exploitation mitigation",
        "impact of an incident"
      ]
    },
    {
      "vendor": "cycode",
      "requirement": "I-2l",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://cycode.com/platform/",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "logging",
        "audit log",
        "security monitoring"
      ]
    },
    {
      "vendor": "cycode",
      "requirement": "I-2m",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://cycode.com/platform/",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "data deletion",
        "delete all data",
        "data portability"
      ]
    },
    {
      "vendor": "cycode",
      "requirement": "II-1",
      "value": "documented",
      "kinds": [
        "produces"
      ],
      "sourceUrl": "https://cycode.com/sca-software-composition-analysis/",
      "accessed": "2026-10-01",
      "snippet": "Using the Cycode SCA scanner, you always maintain an up-to-date software bill of materials",
      "specific": true
    },
    {
      "vendor": "cycode",
      "requirement": "II-2",
      "value": "documented",
      "kinds": [
        "drafts"
      ],
      "sourceUrl": "https://cycode.com/",
      "accessed": "2026-10-01",
      "snippet": "Generates PR-ready fixes with reasoning",
      "specific": true
    },
    {
      "vendor": "cycode",
      "requirement": "II-3",
      "value": "documented",
      "kinds": [
        "verifies"
      ],
      "sourceUrl": "https://cycode.com/sast-static-application-security-testing/",
      "accessed": "2026-10-01",
      "snippet": "scan that runs against the full codebase during CI builds",
      "specific": true
    },
    {
      "vendor": "cycode",
      "requirement": "II-4",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://cycode.com/platform/",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "advisory",
        "advisories",
        "CSAF"
      ]
    },
    {
      "vendor": "cycode",
      "requirement": "II-5",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://cycode.com/platform/",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "coordinated vulnerability disclosure",
        "CVD",
        "disclosure policy"
      ]
    },
    {
      "vendor": "cycode",
      "requirement": "II-6",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://cycode.com/platform/",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "security.txt",
        "report a vulnerability",
        "reporting channel"
      ]
    },
    {
      "vendor": "cycode",
      "requirement": "II-7",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://cycode.com/platform/",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "update distribution",
        "signed update",
        "secure delivery"
      ]
    },
    {
      "vendor": "cycode",
      "requirement": "II-8",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://cycode.com/platform/",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "security patch",
        "free of charge",
        "without delay"
      ]
    },
    {
      "vendor": "drata",
      "requirement": "I-1",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://drata.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "Use requirements built around CRA, with mapped controls and evidence workflows",
      "specific": false
    },
    {
      "vendor": "drata",
      "requirement": "I-2a",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://drata.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "Use requirements built around CRA, with mapped controls and evidence workflows",
      "specific": false
    },
    {
      "vendor": "drata",
      "requirement": "I-2b",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://drata.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "Use requirements built around CRA, with mapped controls and evidence workflows",
      "specific": false
    },
    {
      "vendor": "drata",
      "requirement": "I-2c",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://drata.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "Use requirements built around CRA, with mapped controls and evidence workflows",
      "specific": false
    },
    {
      "vendor": "drata",
      "requirement": "I-2d",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://drata.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "Use requirements built around CRA, with mapped controls and evidence workflows",
      "specific": false
    },
    {
      "vendor": "drata",
      "requirement": "I-2e",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://drata.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "Use requirements built around CRA, with mapped controls and evidence workflows",
      "specific": false
    },
    {
      "vendor": "drata",
      "requirement": "I-2f",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://drata.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "Use requirements built around CRA, with mapped controls and evidence workflows",
      "specific": false
    },
    {
      "vendor": "drata",
      "requirement": "I-2g",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://drata.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "Use requirements built around CRA, with mapped controls and evidence workflows",
      "specific": false
    },
    {
      "vendor": "drata",
      "requirement": "I-2h",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://drata.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "Use requirements built around CRA, with mapped controls and evidence workflows",
      "specific": false
    },
    {
      "vendor": "drata",
      "requirement": "I-2i",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://drata.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "Use requirements built around CRA, with mapped controls and evidence workflows",
      "specific": false
    },
    {
      "vendor": "drata",
      "requirement": "I-2j",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://drata.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "Use requirements built around CRA, with mapped controls and evidence workflows",
      "specific": false
    },
    {
      "vendor": "drata",
      "requirement": "I-2k",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://drata.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "Use requirements built around CRA, with mapped controls and evidence workflows",
      "specific": false
    },
    {
      "vendor": "drata",
      "requirement": "I-2l",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://drata.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "Use requirements built around CRA, with mapped controls and evidence workflows",
      "specific": false
    },
    {
      "vendor": "drata",
      "requirement": "I-2m",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://drata.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "Use requirements built around CRA, with mapped controls and evidence workflows",
      "specific": false
    },
    {
      "vendor": "drata",
      "requirement": "II-1",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://drata.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "Use requirements built around CRA, with mapped controls and evidence workflows",
      "specific": false
    },
    {
      "vendor": "drata",
      "requirement": "II-2",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://drata.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "Identify, triage, document, and remediate vulnerabilities affecting in-scope products",
      "specific": true
    },
    {
      "vendor": "drata",
      "requirement": "II-3",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://drata.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "Use requirements built around CRA, with mapped controls and evidence workflows",
      "specific": false
    },
    {
      "vendor": "drata",
      "requirement": "II-4",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://drata.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "Use requirements built around CRA, with mapped controls and evidence workflows",
      "specific": false
    },
    {
      "vendor": "drata",
      "requirement": "II-5",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://drata.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "Use requirements built around CRA, with mapped controls and evidence workflows",
      "specific": false
    },
    {
      "vendor": "drata",
      "requirement": "II-6",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://drata.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "Use requirements built around CRA, with mapped controls and evidence workflows",
      "specific": false
    },
    {
      "vendor": "drata",
      "requirement": "II-7",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://drata.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "Use requirements built around CRA, with mapped controls and evidence workflows",
      "specific": false
    },
    {
      "vendor": "drata",
      "requirement": "II-8",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://drata.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "Use requirements built around CRA, with mapped controls and evidence workflows",
      "specific": false
    },
    {
      "vendor": "hackerone",
      "requirement": "I-1",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.hackerone.com/eu-cyber-resilience-act-solution",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "Annex I",
        "essential cybersecurity requirements",
        "essential requirements"
      ]
    },
    {
      "vendor": "hackerone",
      "requirement": "I-2a",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.hackerone.com/eu-cyber-resilience-act-solution",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "known exploitable vulnerabilit",
        "exploitable vulnerabilit",
        "vulnerability scan"
      ]
    },
    {
      "vendor": "hackerone",
      "requirement": "I-2b",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.hackerone.com/eu-cyber-resilience-act-solution",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "secure by default",
        "secure-by-default",
        "default configuration"
      ]
    },
    {
      "vendor": "hackerone",
      "requirement": "I-2c",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.hackerone.com/eu-cyber-resilience-act-solution",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "security update",
        "OTA",
        "patch management"
      ]
    },
    {
      "vendor": "hackerone",
      "requirement": "I-2d",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.hackerone.com/eu-cyber-resilience-act-solution",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "access control",
        "authentication",
        "unauthorised access"
      ]
    },
    {
      "vendor": "hackerone",
      "requirement": "I-2e",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.hackerone.com/eu-cyber-resilience-act-solution",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "encryption",
        "confidentiality"
      ]
    },
    {
      "vendor": "hackerone",
      "requirement": "I-2f",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.hackerone.com/eu-cyber-resilience-act-solution",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "integrity",
        "tamper",
        "code signing"
      ]
    },
    {
      "vendor": "hackerone",
      "requirement": "I-2g",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.hackerone.com/eu-cyber-resilience-act-solution",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "data minimi",
        "personal data"
      ]
    },
    {
      "vendor": "hackerone",
      "requirement": "I-2h",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.hackerone.com/eu-cyber-resilience-act-solution",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "availability",
        "denial of service",
        "denial-of-service"
      ]
    },
    {
      "vendor": "hackerone",
      "requirement": "I-2i",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.hackerone.com/eu-cyber-resilience-act-solution",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "other devices",
        "network impact"
      ]
    },
    {
      "vendor": "hackerone",
      "requirement": "I-2j",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.hackerone.com/eu-cyber-resilience-act-solution",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "attack surface",
        "external interfaces",
        "open ports"
      ]
    },
    {
      "vendor": "hackerone",
      "requirement": "I-2k",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.hackerone.com/eu-cyber-resilience-act-solution",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "exploit mitigation",
        "exploitation mitigation",
        "impact of an incident"
      ]
    },
    {
      "vendor": "hackerone",
      "requirement": "I-2l",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.hackerone.com/eu-cyber-resilience-act-solution",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "logging",
        "audit log",
        "security monitoring"
      ]
    },
    {
      "vendor": "hackerone",
      "requirement": "I-2m",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.hackerone.com/eu-cyber-resilience-act-solution",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "data deletion",
        "delete all data",
        "data portability"
      ]
    },
    {
      "vendor": "hackerone",
      "requirement": "II-1",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.hackerone.com/eu-cyber-resilience-act-solution",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "SBOM",
        "bill of materials",
        "CycloneDX"
      ]
    },
    {
      "vendor": "hackerone",
      "requirement": "II-2",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://www.hackerone.com/eu-cyber-resilience-act-solution",
      "accessed": "2026-10-01",
      "snippet": "on one platform that takes you from disclosure to fix.",
      "specific": true
    },
    {
      "vendor": "hackerone",
      "requirement": "II-3",
      "value": "documented",
      "kinds": [
        "verifies"
      ],
      "sourceUrl": "https://www.hackerone.com/eu-cyber-resilience-act-solution",
      "accessed": "2026-10-01",
      "snippet": "Validation that runs between audits and complements your existing testing.",
      "specific": true
    },
    {
      "vendor": "hackerone",
      "requirement": "II-4",
      "value": "documented",
      "kinds": [
        "operates"
      ],
      "sourceUrl": "https://docs.hackerone.com/en/articles/8505210-cve-requests",
      "accessed": "2026-10-01",
      "snippet": "HackerOne will automatically assign a CVE ID and publish it to MITRE",
      "specific": true
    },
    {
      "vendor": "hackerone",
      "requirement": "II-5",
      "value": "documented",
      "kinds": [
        "operates"
      ],
      "sourceUrl": "https://www.hackerone.com/product/response-vulnerability-disclosure-program",
      "accessed": "2026-10-01",
      "snippet": "Your always-on vulnerability disclosure program",
      "specific": true
    },
    {
      "vendor": "hackerone",
      "requirement": "II-6",
      "value": "documented",
      "kinds": [
        "operates"
      ],
      "sourceUrl": "https://www.hackerone.com/product/response-vulnerability-disclosure-program",
      "accessed": "2026-10-01",
      "snippet": "Establish a direct channel for external parties to report discovered vulnerabilities",
      "specific": true
    },
    {
      "vendor": "hackerone",
      "requirement": "II-7",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.hackerone.com/eu-cyber-resilience-act-solution",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "update distribution",
        "signed update",
        "secure delivery"
      ]
    },
    {
      "vendor": "hackerone",
      "requirement": "II-8",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.hackerone.com/eu-cyber-resilience-act-solution",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "security patch",
        "free of charge",
        "without delay"
      ]
    },
    {
      "vendor": "ketryx",
      "requirement": "I-1",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://www.ketryx.com/capabilities/eu-cra",
      "accessed": "2026-10-01",
      "snippet": "Ketryx provides a unified environment for the entire design control and risk management workflow",
      "specific": true
    },
    {
      "vendor": "ketryx",
      "requirement": "I-2a",
      "value": "documented",
      "kinds": [
        "verifies"
      ],
      "sourceUrl": "https://www.ketryx.com/capabilities/eu-cra",
      "accessed": "2026-10-01",
      "snippet": "Continuous GHSA and NVD monitoring with automatic Vulnerability Advisory generation for affected dependencies",
      "specific": true
    },
    {
      "vendor": "ketryx",
      "requirement": "I-2b",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.ketryx.com/capabilities/eu-cra",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "secure by default",
        "secure-by-default",
        "default configuration"
      ]
    },
    {
      "vendor": "ketryx",
      "requirement": "I-2c",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.ketryx.com/capabilities/eu-cra",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "security update",
        "OTA",
        "patch management"
      ]
    },
    {
      "vendor": "ketryx",
      "requirement": "I-2d",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.ketryx.com/capabilities/eu-cra",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "access control",
        "authentication",
        "unauthorised access"
      ]
    },
    {
      "vendor": "ketryx",
      "requirement": "I-2e",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.ketryx.com/capabilities/eu-cra",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "encryption",
        "confidentiality"
      ]
    },
    {
      "vendor": "ketryx",
      "requirement": "I-2f",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.ketryx.com/capabilities/eu-cra",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "integrity",
        "tamper",
        "code signing"
      ]
    },
    {
      "vendor": "ketryx",
      "requirement": "I-2g",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.ketryx.com/capabilities/eu-cra",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "data minimi",
        "personal data"
      ]
    },
    {
      "vendor": "ketryx",
      "requirement": "I-2h",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.ketryx.com/capabilities/eu-cra",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "availability",
        "denial of service",
        "denial-of-service"
      ]
    },
    {
      "vendor": "ketryx",
      "requirement": "I-2i",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.ketryx.com/capabilities/eu-cra",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "other devices",
        "network impact"
      ]
    },
    {
      "vendor": "ketryx",
      "requirement": "I-2j",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.ketryx.com/capabilities/eu-cra",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "attack surface",
        "external interfaces",
        "open ports"
      ]
    },
    {
      "vendor": "ketryx",
      "requirement": "I-2k",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.ketryx.com/capabilities/eu-cra",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "exploit mitigation",
        "exploitation mitigation",
        "impact of an incident"
      ]
    },
    {
      "vendor": "ketryx",
      "requirement": "I-2l",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.ketryx.com/capabilities/eu-cra",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "logging",
        "audit log",
        "security monitoring"
      ]
    },
    {
      "vendor": "ketryx",
      "requirement": "I-2m",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.ketryx.com/capabilities/eu-cra",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "data deletion",
        "delete all data",
        "data portability"
      ]
    },
    {
      "vendor": "ketryx",
      "requirement": "II-1",
      "value": "documented",
      "kinds": [
        "produces"
      ],
      "sourceUrl": "https://www.ketryx.com/capabilities/eu-cra",
      "accessed": "2026-10-01",
      "snippet": "Generate and maintain machine-readable SBOMs automatically from connected Git repositories.",
      "specific": true
    },
    {
      "vendor": "ketryx",
      "requirement": "II-2",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://www.ketryx.com/capabilities/eu-cra",
      "accessed": "2026-10-01",
      "snippet": "Ketryx provides an end-to-end vulnerability management workflow",
      "specific": true
    },
    {
      "vendor": "ketryx",
      "requirement": "II-3",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://www.ketryx.com/capabilities/traceability-to-automated-tests",
      "accessed": "2026-10-01",
      "snippet": "Automatically trace automated tests in Git to requirements in Jira.",
      "specific": true
    },
    {
      "vendor": "ketryx",
      "requirement": "II-4",
      "value": "documented",
      "kinds": [
        "produces"
      ],
      "sourceUrl": "https://www.ketryx.com/capabilities/eu-cra",
      "accessed": "2026-10-01",
      "snippet": "Continuous GHSA and NVD monitoring with automatic Vulnerability Advisory generation for affected dependencies",
      "specific": true
    },
    {
      "vendor": "ketryx",
      "requirement": "II-5",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.ketryx.com/capabilities/eu-cra",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "coordinated vulnerability disclosure",
        "CVD",
        "disclosure policy"
      ]
    },
    {
      "vendor": "ketryx",
      "requirement": "II-6",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.ketryx.com/capabilities/eu-cra",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "security.txt",
        "report a vulnerability",
        "reporting channel"
      ]
    },
    {
      "vendor": "ketryx",
      "requirement": "II-7",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.ketryx.com/capabilities/eu-cra",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "update distribution",
        "signed update",
        "secure delivery"
      ]
    },
    {
      "vendor": "ketryx",
      "requirement": "II-8",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.ketryx.com/capabilities/eu-cra",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "security patch",
        "free of charge",
        "without delay"
      ]
    },
    {
      "vendor": "kunnus",
      "requirement": "I-1",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://kunnus.tech/en/plattform/cra-coverage",
      "accessed": "2026-10-01",
      "snippet": "Appropriate level of cybersecurity based on the risks (security by design) Assessment & evidence",
      "specific": true
    },
    {
      "vendor": "kunnus",
      "requirement": "I-2a",
      "value": "documented",
      "kinds": [
        "verifies"
      ],
      "sourceUrl": "https://kunnus.tech/en/plattform/cra-coverage",
      "accessed": "2026-10-01",
      "snippet": "SBOM-based matching against vulnerability databases before and after release.",
      "specific": true
    },
    {
      "vendor": "kunnus",
      "requirement": "I-2b",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://kunnus.tech/en/plattform/cra-coverage",
      "accessed": "2026-10-01",
      "snippet": "No. 2(b) Secure-by-default configuration and reset capability Assessment & evidence",
      "specific": true
    },
    {
      "vendor": "kunnus",
      "requirement": "I-2c",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://kunnus.tech/en/plattform/cra-coverage",
      "accessed": "2026-10-01",
      "snippet": "Update capability is assessed; the update process per product is documented and evidenced.",
      "specific": true
    },
    {
      "vendor": "kunnus",
      "requirement": "I-2d",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://kunnus.tech/en/plattform/cra-coverage",
      "accessed": "2026-10-01",
      "snippet": "Protection from unauthorised access (authentication, identity and access management) Assessment & evidence",
      "specific": true
    },
    {
      "vendor": "kunnus",
      "requirement": "I-2e",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://kunnus.tech/en/plattform/cra-coverage",
      "accessed": "2026-10-01",
      "snippet": "No. 2(e) Confidentiality of stored, transmitted and processed data (encryption) Assessment & evidence",
      "specific": true
    },
    {
      "vendor": "kunnus",
      "requirement": "I-2f",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://kunnus.tech/en/plattform/cra-coverage",
      "accessed": "2026-10-01",
      "snippet": "No. 2(f) Integrity of data, commands, programs and configuration Assessment & evidence",
      "specific": true
    },
    {
      "vendor": "kunnus",
      "requirement": "I-2g",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://kunnus.tech/en/plattform/cra-coverage",
      "accessed": "2026-10-01",
      "snippet": "Data minimisation: processing only data necessary for the intended purpose Assessment & evidence",
      "specific": true
    },
    {
      "vendor": "kunnus",
      "requirement": "I-2h",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://kunnus.tech/en/plattform/cra-coverage",
      "accessed": "2026-10-01",
      "snippet": "Availability of essential functions, incl. after incidents (DoS resilience) Assessment & evidence",
      "specific": true
    },
    {
      "vendor": "kunnus",
      "requirement": "I-2i",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://kunnus.tech/en/plattform/cra-coverage",
      "accessed": "2026-10-01",
      "snippet": "Minimising negative impact on services provided by other devices or networks Assessment & evidence",
      "specific": true
    },
    {
      "vendor": "kunnus",
      "requirement": "I-2j",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://kunnus.tech/en/plattform/cra-coverage",
      "accessed": "2026-10-01",
      "snippet": "No. 2(j) Limited attack surfaces, including external interfaces Assessment & evidence",
      "specific": true
    },
    {
      "vendor": "kunnus",
      "requirement": "I-2k",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://kunnus.tech/en/plattform/cra-coverage",
      "accessed": "2026-10-01",
      "snippet": "No. 2(k) Reducing the impact of incidents (exploitation mitigation) Assessment & evidence",
      "specific": true
    },
    {
      "vendor": "kunnus",
      "requirement": "I-2l",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://kunnus.tech/en/plattform/cra-coverage",
      "accessed": "2026-10-01",
      "snippet": "Recording and monitoring of security-relevant internal activity (with opt-out) Assessment & evidence",
      "specific": true
    },
    {
      "vendor": "kunnus",
      "requirement": "I-2m",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://kunnus.tech/en/plattform/cra-coverage",
      "accessed": "2026-10-01",
      "snippet": "Secure and easy deletion and secure transfer of data and settings Assessment & evidence",
      "specific": true
    },
    {
      "vendor": "kunnus",
      "requirement": "II-1",
      "value": "documented",
      "kinds": [
        "produces",
        "records"
      ],
      "sourceUrl": "https://kunnus.tech/en/plattform/cra-coverage",
      "accessed": "2026-10-01",
      "snippet": "SBOM generation and import (multiple formats), dependency tracking across all products and versions.",
      "specific": true
    },
    {
      "vendor": "kunnus",
      "requirement": "II-2",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://kunnus.tech/en/plattform/cra-coverage",
      "accessed": "2026-10-01",
      "snippet": "Triage, prioritisation and status tracking to resolution in the platform",
      "specific": true
    },
    {
      "vendor": "kunnus",
      "requirement": "II-3",
      "value": "documented",
      "kinds": [
        "verifies"
      ],
      "sourceUrl": "https://kunnus.tech/en/plattform/cra-coverage",
      "accessed": "2026-10-01",
      "snippet": "Continuous vulnerability monitoring plus CI scans with the open-source kunnus-scanner",
      "specific": true
    },
    {
      "vendor": "kunnus",
      "requirement": "II-4",
      "value": "documented",
      "kinds": [
        "produces"
      ],
      "sourceUrl": "https://kunnus.tech/en/plattform/reporting",
      "accessed": "2026-10-01",
      "snippet": "The security advisory can be created straight from the case — in CSAF format",
      "specific": true
    },
    {
      "vendor": "kunnus",
      "requirement": "II-5",
      "value": "documented",
      "kinds": [
        "drafts",
        "records"
      ],
      "sourceUrl": "https://kunnus.tech/en/plattform/cra-coverage",
      "accessed": "2026-10-01",
      "snippet": "The CVD policy is created in the platform itself: adapt the policy-library template",
      "specific": true
    },
    {
      "vendor": "kunnus",
      "requirement": "II-6",
      "value": "documented",
      "kinds": [
        "operates"
      ],
      "sourceUrl": "https://kunnus.tech/en/plattform/cra-coverage",
      "accessed": "2026-10-01",
      "snippet": "External reporters submit vulnerabilities via a shareable link, no account needed.",
      "specific": true
    },
    {
      "vendor": "kunnus",
      "requirement": "II-7",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://kunnus.tech/en/plattform/cra-coverage",
      "accessed": "2026-10-01",
      "snippet": "No. 7 Mechanisms for secure distribution of updates Assessment & evidence",
      "specific": true
    },
    {
      "vendor": "kunnus",
      "requirement": "II-8",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://kunnus.tech/en/plattform/cra-coverage",
      "accessed": "2026-10-01",
      "snippet": "disseminated without delay and free of charge, with advisories for users Assessment & evidence",
      "specific": true
    },
    {
      "vendor": "onekey",
      "requirement": "I-1",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.onekey.com/platform-guide/getting-started/compliance-wizard/",
      "accessed": "2026-10-01",
      "snippet": "The tool guides you through each provision and points out gaps or potential violations.",
      "specific": false
    },
    {
      "vendor": "onekey",
      "requirement": "I-2a",
      "value": "documented",
      "kinds": [
        "verifies"
      ],
      "sourceUrl": "https://www.onekey.com/",
      "accessed": "2026-10-01",
      "snippet": "Let our platform detect and prioritize any known or unknown firmware vulnerabilities for you.",
      "specific": true
    },
    {
      "vendor": "onekey",
      "requirement": "I-2b",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.onekey.com/platform-guide/getting-started/compliance-wizard/",
      "accessed": "2026-10-01",
      "snippet": "The tool guides you through each provision and points out gaps or potential violations.",
      "specific": false
    },
    {
      "vendor": "onekey",
      "requirement": "I-2c",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.onekey.com/platform-guide/getting-started/compliance-wizard/",
      "accessed": "2026-10-01",
      "snippet": "The tool guides you through each provision and points out gaps or potential violations.",
      "specific": false
    },
    {
      "vendor": "onekey",
      "requirement": "I-2d",
      "value": "documented",
      "kinds": [
        "verifies"
      ],
      "sourceUrl": "https://www.onekey.com/feature/monitoring",
      "accessed": "2026-10-01",
      "snippet": "Code analysis separately finds hardcoded credentials, weak crypto and injection patterns.",
      "specific": true
    },
    {
      "vendor": "onekey",
      "requirement": "I-2e",
      "value": "documented",
      "kinds": [
        "verifies"
      ],
      "sourceUrl": "https://www.onekey.com/feature/monitoring",
      "accessed": "2026-10-01",
      "snippet": "Code analysis separately finds hardcoded credentials, weak crypto and injection patterns.",
      "specific": true
    },
    {
      "vendor": "onekey",
      "requirement": "I-2f",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.onekey.com/platform-guide/getting-started/compliance-wizard/",
      "accessed": "2026-10-01",
      "snippet": "The tool guides you through each provision and points out gaps or potential violations.",
      "specific": false
    },
    {
      "vendor": "onekey",
      "requirement": "I-2g",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.onekey.com/platform-guide/getting-started/compliance-wizard/",
      "accessed": "2026-10-01",
      "snippet": "The tool guides you through each provision and points out gaps or potential violations.",
      "specific": false
    },
    {
      "vendor": "onekey",
      "requirement": "I-2h",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.onekey.com/platform-guide/getting-started/compliance-wizard/",
      "accessed": "2026-10-01",
      "snippet": "The tool guides you through each provision and points out gaps or potential violations.",
      "specific": false
    },
    {
      "vendor": "onekey",
      "requirement": "I-2i",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.onekey.com/platform-guide/getting-started/compliance-wizard/",
      "accessed": "2026-10-01",
      "snippet": "The tool guides you through each provision and points out gaps or potential violations.",
      "specific": false
    },
    {
      "vendor": "onekey",
      "requirement": "I-2j",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.onekey.com/platform-guide/getting-started/compliance-wizard/",
      "accessed": "2026-10-01",
      "snippet": "The tool guides you through each provision and points out gaps or potential violations.",
      "specific": false
    },
    {
      "vendor": "onekey",
      "requirement": "I-2k",
      "value": "documented",
      "kinds": [
        "verifies"
      ],
      "sourceUrl": "https://www.onekey.com/feature/zero-day-detection",
      "accessed": "2026-10-01",
      "snippet": "checks binary hardening, such as missing stack canaries, NX stack or RELRO",
      "specific": true
    },
    {
      "vendor": "onekey",
      "requirement": "I-2l",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.onekey.com/platform-guide/getting-started/compliance-wizard/",
      "accessed": "2026-10-01",
      "snippet": "The tool guides you through each provision and points out gaps or potential violations.",
      "specific": false
    },
    {
      "vendor": "onekey",
      "requirement": "I-2m",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.onekey.com/platform-guide/getting-started/compliance-wizard/",
      "accessed": "2026-10-01",
      "snippet": "The tool guides you through each provision and points out gaps or potential violations.",
      "specific": false
    },
    {
      "vendor": "onekey",
      "requirement": "II-1",
      "value": "documented",
      "kinds": [
        "produces"
      ],
      "sourceUrl": "https://docs.onekey.com/platform-guide/features/sbom-management/",
      "accessed": "2026-10-01",
      "snippet": "ONEKEY automatically generates an SBOM from the firmware image during analysis.",
      "specific": true
    },
    {
      "vendor": "onekey",
      "requirement": "II-2",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.onekey.com/platform-guide/features/vulnerability-management/",
      "accessed": "2026-10-01",
      "snippet": "Triage and evaluate security issues and CVEs using CVSS Environmental scores",
      "specific": true
    },
    {
      "vendor": "onekey",
      "requirement": "II-3",
      "value": "documented",
      "kinds": [
        "verifies"
      ],
      "sourceUrl": "https://www.onekey.com/feature/zero-day-detection",
      "accessed": "2026-10-01",
      "snippet": "Every build can be checked automatically through CI/CD.",
      "specific": true
    },
    {
      "vendor": "onekey",
      "requirement": "II-4",
      "value": "documented",
      "kinds": [
        "produces"
      ],
      "sourceUrl": "https://docs.onekey.com/platform-guide/features/vulnerability-management/",
      "accessed": "2026-10-01",
      "snippet": "Exporting VEX information can, for example, support compliance with certain cybersecurity regulations",
      "specific": true
    },
    {
      "vendor": "onekey",
      "requirement": "II-5",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.onekey.com/platform-guide/getting-started/compliance-wizard/",
      "accessed": "2026-10-01",
      "snippet": "The tool guides you through each provision and points out gaps or potential violations.",
      "specific": false
    },
    {
      "vendor": "onekey",
      "requirement": "II-6",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.onekey.com/platform-guide/getting-started/compliance-wizard/",
      "accessed": "2026-10-01",
      "snippet": "The tool guides you through each provision and points out gaps or potential violations.",
      "specific": false
    },
    {
      "vendor": "onekey",
      "requirement": "II-7",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.onekey.com/platform-guide/getting-started/compliance-wizard/",
      "accessed": "2026-10-01",
      "snippet": "The tool guides you through each provision and points out gaps or potential violations.",
      "specific": false
    },
    {
      "vendor": "onekey",
      "requirement": "II-8",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://docs.onekey.com/platform-guide/getting-started/compliance-wizard/",
      "accessed": "2026-10-01",
      "snippet": "The tool guides you through each provision and points out gaps or potential violations.",
      "specific": false
    },
    {
      "vendor": "vanta",
      "requirement": "I-1",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.vanta.com/products/additional-frameworks",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "Annex I",
        "essential cybersecurity requirements",
        "essential requirements"
      ]
    },
    {
      "vendor": "vanta",
      "requirement": "I-2a",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.vanta.com/products/additional-frameworks",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "known exploitable vulnerabilit",
        "exploitable vulnerabilit",
        "vulnerability scan"
      ]
    },
    {
      "vendor": "vanta",
      "requirement": "I-2b",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.vanta.com/products/additional-frameworks",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "secure by default",
        "secure-by-default",
        "default configuration"
      ]
    },
    {
      "vendor": "vanta",
      "requirement": "I-2c",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.vanta.com/products/additional-frameworks",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "security update",
        "OTA",
        "patch management"
      ]
    },
    {
      "vendor": "vanta",
      "requirement": "I-2d",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.vanta.com/products/additional-frameworks",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "access control",
        "authentication",
        "unauthorised access"
      ]
    },
    {
      "vendor": "vanta",
      "requirement": "I-2e",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.vanta.com/products/additional-frameworks",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "encryption",
        "confidentiality"
      ]
    },
    {
      "vendor": "vanta",
      "requirement": "I-2f",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.vanta.com/products/additional-frameworks",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "integrity",
        "tamper",
        "code signing"
      ]
    },
    {
      "vendor": "vanta",
      "requirement": "I-2g",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.vanta.com/products/additional-frameworks",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "data minimi",
        "personal data"
      ]
    },
    {
      "vendor": "vanta",
      "requirement": "I-2h",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.vanta.com/products/additional-frameworks",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "availability",
        "denial of service",
        "denial-of-service"
      ]
    },
    {
      "vendor": "vanta",
      "requirement": "I-2i",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.vanta.com/products/additional-frameworks",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "other devices",
        "network impact"
      ]
    },
    {
      "vendor": "vanta",
      "requirement": "I-2j",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.vanta.com/products/additional-frameworks",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "attack surface",
        "external interfaces",
        "open ports"
      ]
    },
    {
      "vendor": "vanta",
      "requirement": "I-2k",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.vanta.com/products/additional-frameworks",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "exploit mitigation",
        "exploitation mitigation",
        "impact of an incident"
      ]
    },
    {
      "vendor": "vanta",
      "requirement": "I-2l",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.vanta.com/products/additional-frameworks",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "logging",
        "audit log",
        "security monitoring"
      ]
    },
    {
      "vendor": "vanta",
      "requirement": "I-2m",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.vanta.com/products/additional-frameworks",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "data deletion",
        "delete all data",
        "data portability"
      ]
    },
    {
      "vendor": "vanta",
      "requirement": "II-1",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.vanta.com/products/additional-frameworks",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "SBOM",
        "bill of materials",
        "CycloneDX"
      ]
    },
    {
      "vendor": "vanta",
      "requirement": "II-2",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.vanta.com/products/additional-frameworks",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "remediat",
        "vulnerability management",
        "vulnerability handling"
      ]
    },
    {
      "vendor": "vanta",
      "requirement": "II-3",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.vanta.com/products/additional-frameworks",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "security testing",
        "penetration test",
        "pentest"
      ]
    },
    {
      "vendor": "vanta",
      "requirement": "II-4",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.vanta.com/products/additional-frameworks",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "advisory",
        "advisories",
        "CSAF"
      ]
    },
    {
      "vendor": "vanta",
      "requirement": "II-5",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.vanta.com/products/additional-frameworks",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "coordinated vulnerability disclosure",
        "CVD",
        "disclosure policy"
      ]
    },
    {
      "vendor": "vanta",
      "requirement": "II-6",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.vanta.com/products/additional-frameworks",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "security.txt",
        "report a vulnerability",
        "reporting channel"
      ]
    },
    {
      "vendor": "vanta",
      "requirement": "II-7",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.vanta.com/products/additional-frameworks",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "update distribution",
        "signed update",
        "secure delivery"
      ]
    },
    {
      "vendor": "vanta",
      "requirement": "II-8",
      "value": "not_documented",
      "kinds": [],
      "sourceUrl": "https://www.vanta.com/products/additional-frameworks",
      "accessed": "2026-10-01",
      "snippet": "",
      "specific": false,
      "searchTerms": [
        "security patch",
        "free of charge",
        "without delay"
      ]
    },
    {
      "vendor": "venvera",
      "requirement": "I-1",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://venvera.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "documented per-product risk assessment that Venvera holds alongside the controls",
      "specific": true
    },
    {
      "vendor": "venvera",
      "requirement": "I-2a",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://venvera.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "controls with evidence: a secure-by-default configuration, no known exploitable vulnerabilities",
      "specific": true
    },
    {
      "vendor": "venvera",
      "requirement": "I-2b",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://venvera.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "controls with evidence: a secure-by-default configuration, no known exploitable vulnerabilities",
      "specific": true
    },
    {
      "vendor": "venvera",
      "requirement": "I-2c",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://venvera.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "a limited attack surface, and the ability to be updated.",
      "specific": true
    },
    {
      "vendor": "venvera",
      "requirement": "I-2d",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://venvera.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "protection against unauthorised access, confidentiality and integrity of data, data minimisation",
      "specific": true
    },
    {
      "vendor": "venvera",
      "requirement": "I-2e",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://venvera.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "protection against unauthorised access, confidentiality and integrity of data, data minimisation",
      "specific": true
    },
    {
      "vendor": "venvera",
      "requirement": "I-2f",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://venvera.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "protection against unauthorised access, confidentiality and integrity of data, data minimisation",
      "specific": true
    },
    {
      "vendor": "venvera",
      "requirement": "I-2g",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://venvera.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "protection against unauthorised access, confidentiality and integrity of data, data minimisation",
      "specific": true
    },
    {
      "vendor": "venvera",
      "requirement": "I-2h",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://venvera.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "data minimisation, availability and denial-of-service resilience, a limited attack surface",
      "specific": true
    },
    {
      "vendor": "venvera",
      "requirement": "I-2i",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://venvera.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "Venvera tracks the Annex I Part I requirements as controls with evidence",
      "specific": false
    },
    {
      "vendor": "venvera",
      "requirement": "I-2j",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://venvera.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "data minimisation, availability and denial-of-service resilience, a limited attack surface",
      "specific": true
    },
    {
      "vendor": "venvera",
      "requirement": "I-2k",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://venvera.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "Venvera tracks the Annex I Part I requirements as controls with evidence",
      "specific": false
    },
    {
      "vendor": "venvera",
      "requirement": "I-2l",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://venvera.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "Venvera tracks the Annex I Part I requirements as controls with evidence",
      "specific": false
    },
    {
      "vendor": "venvera",
      "requirement": "I-2m",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://venvera.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "Venvera tracks the Annex I Part I requirements as controls with evidence",
      "specific": false
    },
    {
      "vendor": "venvera",
      "requirement": "II-1",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://venvera.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "Venvera tracks the vulnerability-handling machinery: a software bill of materials in a machine-readable format",
      "specific": true
    },
    {
      "vendor": "venvera",
      "requirement": "II-2",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://venvera.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "a published coordinated vulnerability disclosure policy, a handling process that remediates without delay",
      "specific": true
    },
    {
      "vendor": "venvera",
      "requirement": "II-3",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://venvera.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "a handling process that remediates without delay and ships advisories, regular security testing",
      "specific": true
    },
    {
      "vendor": "venvera",
      "requirement": "II-4",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://venvera.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "a handling process that remediates without delay and ships advisories, regular security testing",
      "specific": true
    },
    {
      "vendor": "venvera",
      "requirement": "II-5",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://venvera.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "a published coordinated vulnerability disclosure policy, a handling process that remediates without delay",
      "specific": true
    },
    {
      "vendor": "venvera",
      "requirement": "II-6",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://venvera.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "Venvera tracks the vulnerability-handling machinery",
      "specific": false
    },
    {
      "vendor": "venvera",
      "requirement": "II-7",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://venvera.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "Venvera tracks the vulnerability-handling machinery",
      "specific": false
    },
    {
      "vendor": "venvera",
      "requirement": "II-8",
      "value": "documented",
      "kinds": [
        "records"
      ],
      "sourceUrl": "https://venvera.com/frameworks/cra",
      "accessed": "2026-10-01",
      "snippet": "Vulnerability handling with advisories and timely security updates",
      "specific": true
    }
  ]
}