Skip to main content

Which CRA tools document support for each Annex I requirement?

The cradata.eu register records, for each of 22 CRA Annex I requirements, whether 13 CRA tools document support on their own public pages, with a quoted source and the date it was checked.

Last updated 2026-10-01. Method.

Key takeaways​

  • A cell records what a vendor states in public. The register does not test products.
  • "Not documented" means the search found no public statement on the date shown. It does not mean the product lacks the feature.
  • Each cell links to the vendor page it quotes. A reader can check every cell.
  • Porta Regulus B.V. operates cradata.eu and also sells CVD Portal, one of the 13 tools. Every column follows the same rules.

How to read a cell​

CodeKindThe source must show
RrecordsA place in the product to store the manufacturer's answer or file for this requirement. A checklist row with a text field meets it.
DdraftsThe product writes a draft for this requirement and a person must review it. AI generated text is always drafts, never produces.
PproducesThe product creates the evidence from data it measured or imported, with no model in between.
VverifiesThe product tests the manufacturer's product against this requirement and stores the result. A scan of the manufacturer's own website does not count unless the requirement is about that website.
OoperatesThe product itself performs the obligation for the manufacturer, in public. Examples are a hosted reporting channel that researchers use, a security.txt file that the product serves, and advisories that the product publishes. A form that stores a link to the manufacturer's own channel is records, not operates.

An asterisk (*) marks a claim with specific false. n/d marks not_documented.

The register​

RequirementAnchoreArmorCodeCETome CRAtedCRA Evidence PlatformCVD PortalCycodeDrataHackerOneKetryxKunnusONEKEYVantaVenvera
I-1. Appropriate level of cybersecurity based on the risksn/dn/dR*RRn/dR*n/dRRR*n/dR
I-2a. No known exploitable vulnerabilitiesVn/dR*VVVR*n/dVVVn/dR
I-2b. Secure by defaultn/dn/dR*R*Rn/dR*n/dn/dRR*n/dR
I-2c. Security updatesn/dn/dR*R*R*n/dR*n/dn/dRR*n/dR
I-2d. Protection from unauthorised accessVn/dR*R*R*VR*n/dn/dRVn/dR
I-2e. Confidentiality of datan/dn/dR*R*R*n/dR*n/dn/dRVn/dR
I-2f. Integrity of datan/dn/dR*R*R*n/dR*n/dn/dRR*n/dR
I-2g. Data minimisationn/dn/dR*R*R*n/dR*n/dn/dRR*n/dR
I-2h. Availability of essential functionsn/dn/dR*R*R*n/dR*n/dn/dRR*n/dR
I-2i. Minimise impact on other devicesn/dn/dR*R*R*n/dR*n/dn/dRR*n/dR*
I-2j. Limit attack surfacesn/dn/dR*R*R*n/dR*n/dn/dRR*n/dR
I-2k. Reduce impact of incidentsn/dn/dR*R*R*n/dR*n/dn/dRVn/dR*
I-2l. Security-relevant loggingn/dn/dR*R*R*n/dR*n/dn/dRR*n/dR*
I-2m. Secure data deletion / portabilityn/dn/dR*R*Dn/dR*n/dn/dRR*n/dR*
II-1. Identify & document vulnerabilities and components (SBOM)PPR*RRPR*n/dPP RPn/dR
II-2. Address & remediate without delayRRR*RRDRRRRRn/dR
II-3. Regular security testing & reviewsVn/dR*VR*VR*VRVVn/dR
II-4. Public disclosure of fixed vulnerabilitiesPPR*PPn/dR*OPPPn/dR
II-5. Coordinated vulnerability disclosure policyn/dn/dR*R*On/dR*On/dD RR*n/dR
II-6. Facilitate vulnerability information sharingn/dn/dR*R*P On/dR*On/dOR*n/dR*
II-7. Secure update distributionn/dn/dR*R*Rn/dR*n/dn/dRR*n/dR*
II-8. Timely, free security patchesRn/dR*R*R On/dR*n/dn/dRR*n/dR

Sources​

Anchore​

  • I-1. not_documented. Source (accessed 2026-10-01).
  • I-2a. documented (verifies). "each of which returns STOP when a finding is listed on the CISA KEV catalog". Source (accessed 2026-10-01).
  • I-2b. not_documented. Source (accessed 2026-10-01).
  • I-2c. not_documented. Source (accessed 2026-10-01).
  • I-2d. documented (verifies). "allows users to perform checks against secrets and content found in an image SBOM". Source (accessed 2026-10-01).
  • I-2e. not_documented. Source (accessed 2026-10-01).
  • I-2f. not_documented. Source (accessed 2026-10-01).
  • I-2g. not_documented. Source (accessed 2026-10-01).
  • I-2h. not_documented. Source (accessed 2026-10-01).
  • I-2i. not_documented. Source (accessed 2026-10-01).
  • I-2j. not_documented. Source (accessed 2026-10-01).
  • I-2k. not_documented. Source (accessed 2026-10-01).
  • I-2l. not_documented. Source (accessed 2026-10-01).
  • I-2m. not_documented. Source (accessed 2026-10-01).
  • II-1. documented (produces). "export the unified SBOM as CycloneDX 1.6 or SPDX 2.3". Source (accessed 2026-10-01).
  • II-2. documented (records). "Document your engineering analysis as vulnerability annotations using the standard VEX status and justification vocabulary.". Source (accessed 2026-10-01).
  • II-3. documented (verifies). "continuous policy evaluation constitutes the regular testing and review Annex I Part II (3)". Source (accessed 2026-10-01).
  • II-4. documented (produces). "For the public advisory obligation (Annex I Part II (4)), export the VEX document". Source (accessed 2026-10-01).
  • II-5. not_documented. Source (accessed 2026-10-01).
  • II-6. not_documented. Source (accessed 2026-10-01).
  • II-7. not_documented. Source (accessed 2026-10-01).
  • II-8. documented (records). "Model the security update as a new linked version containing the fixed components". Source (accessed 2026-10-01).

ArmorCode​

  • I-1. not_documented. Source (accessed 2026-10-01).
  • I-2a. not_documented. Source (accessed 2026-10-01).
  • I-2b. not_documented. Source (accessed 2026-10-01).
  • I-2c. not_documented. Source (accessed 2026-10-01).
  • I-2d. not_documented. Source (accessed 2026-10-01).
  • I-2e. not_documented. Source (accessed 2026-10-01).
  • I-2f. not_documented. Source (accessed 2026-10-01).
  • I-2g. not_documented. Source (accessed 2026-10-01).
  • I-2h. not_documented. Source (accessed 2026-10-01).
  • I-2i. not_documented. Source (accessed 2026-10-01).
  • I-2j. not_documented. Source (accessed 2026-10-01).
  • I-2k. not_documented. Source (accessed 2026-10-01).
  • I-2l. not_documented. Source (accessed 2026-10-01).
  • I-2m. not_documented. Source (accessed 2026-10-01).
  • II-1. documented (produces). "Generate and share tamper-resistant SBOM and VEX disclosures from a single platform.". Source (accessed 2026-10-01).
  • II-2. documented (records). "Leverage Anya, ArmorCode’s agentic AI framework, to speed CRA readiness and vulnerability remediation.". Source (accessed 2026-10-01).
  • II-3. not_documented. Source (accessed 2026-10-01).
  • II-4. documented (produces). "Continuous SBOM and VEX in CycloneDX, refreshed from every release.". Source (accessed 2026-10-01).
  • II-5. not_documented. Source (accessed 2026-10-01).
  • II-6. not_documented. Source (accessed 2026-10-01).
  • II-7. not_documented. Source (accessed 2026-10-01).
  • II-8. not_documented. Source (accessed 2026-10-01).

CETome CRAted​

  • I-1. documented (records). "Answer the Annex I requirements through simple verification questions, with evidence". Source (accessed 2026-10-01).
  • I-2a. documented (records). "Answer the Annex I requirements through simple verification questions, with evidence". Source (accessed 2026-10-01).
  • I-2b. documented (records). "Answer the Annex I requirements through simple verification questions, with evidence". Source (accessed 2026-10-01).
  • I-2c. documented (records). "Answer the Annex I requirements through simple verification questions, with evidence". Source (accessed 2026-10-01).
  • I-2d. documented (records). "Answer the Annex I requirements through simple verification questions, with evidence". Source (accessed 2026-10-01).
  • I-2e. documented (records). "Answer the Annex I requirements through simple verification questions, with evidence". Source (accessed 2026-10-01).
  • I-2f. documented (records). "Answer the Annex I requirements through simple verification questions, with evidence". Source (accessed 2026-10-01).
  • I-2g. documented (records). "Answer the Annex I requirements through simple verification questions, with evidence". Source (accessed 2026-10-01).
  • I-2h. documented (records). "Answer the Annex I requirements through simple verification questions, with evidence". Source (accessed 2026-10-01).
  • I-2i. documented (records). "Answer the Annex I requirements through simple verification questions, with evidence". Source (accessed 2026-10-01).
  • I-2j. documented (records). "Answer the Annex I requirements through simple verification questions, with evidence". Source (accessed 2026-10-01).
  • I-2k. documented (records). "Answer the Annex I requirements through simple verification questions, with evidence". Source (accessed 2026-10-01).
  • I-2l. documented (records). "Answer the Annex I requirements through simple verification questions, with evidence". Source (accessed 2026-10-01).
  • I-2m. documented (records). "Answer the Annex I requirements through simple verification questions, with evidence". Source (accessed 2026-10-01).
  • II-1. documented (records). "Answer the Annex I requirements through simple verification questions, with evidence". Source (accessed 2026-10-01).
  • II-2. documented (records). "Answer the Annex I requirements through simple verification questions, with evidence". Source (accessed 2026-10-01).
  • II-3. documented (records). "Answer the Annex I requirements through simple verification questions, with evidence". Source (accessed 2026-10-01).
  • II-4. documented (records). "Answer the Annex I requirements through simple verification questions, with evidence". Source (accessed 2026-10-01).
  • II-5. documented (records). "Answer the Annex I requirements through simple verification questions, with evidence". Source (accessed 2026-10-01).
  • II-6. documented (records). "Answer the Annex I requirements through simple verification questions, with evidence". Source (accessed 2026-10-01).
  • II-7. documented (records). "Answer the Annex I requirements through simple verification questions, with evidence". Source (accessed 2026-10-01).
  • II-8. documented (records). "Answer the Annex I requirements through simple verification questions, with evidence". Source (accessed 2026-10-01).

CRA Evidence Platform​

  • I-1. documented (records). "Generate your EU Declaration of Conformity, risk assessment, and technical file for every release". Source (accessed 2026-10-01).
  • I-2a. documented (verifies). "Automated Vulnerability Scanning Scan SBOMs against our Vulnerability Knowledge Base". Source (accessed 2026-10-01).
  • I-2b. documented (records). "Score your product against CRA Annex I security requirements.". Source (accessed 2026-10-01).
  • I-2c. documented (records). "Score your product against CRA Annex I security requirements.". Source (accessed 2026-10-01).
  • I-2d. documented (records). "Score your product against CRA Annex I security requirements.". Source (accessed 2026-10-01).
  • I-2e. documented (records). "Score your product against CRA Annex I security requirements.". Source (accessed 2026-10-01).
  • I-2f. documented (records). "Score your product against CRA Annex I security requirements.". Source (accessed 2026-10-01).
  • I-2g. documented (records). "Score your product against CRA Annex I security requirements.". Source (accessed 2026-10-01).
  • I-2h. documented (records). "Score your product against CRA Annex I security requirements.". Source (accessed 2026-10-01).
  • I-2i. documented (records). "Score your product against CRA Annex I security requirements.". Source (accessed 2026-10-01).
  • I-2j. documented (records). "Score your product against CRA Annex I security requirements.". Source (accessed 2026-10-01).
  • I-2k. documented (records). "Score your product against CRA Annex I security requirements.". Source (accessed 2026-10-01).
  • I-2l. documented (records). "Score your product against CRA Annex I security requirements.". Source (accessed 2026-10-01).
  • I-2m. documented (records). "Score your product against CRA Annex I security requirements.". Source (accessed 2026-10-01).
  • II-1. documented (records). "Automated SBOM Validation Upload and validate CycloneDX artifacts". Source (accessed 2026-10-01).
  • II-2. documented (records). "Track remediation and ENISA reporting deadlines per version.". Source (accessed 2026-10-01).
  • II-3. documented (verifies). "Upload SBOMs, trigger scans, and gate releases from CI.". Source (accessed 2026-10-01).
  • II-4. documented (produces). "Generate VEX statements automatically, or author them yourself". Source (accessed 2026-10-01).
  • II-5. documented (records). "Score your product against CRA Annex I security requirements.". Source (accessed 2026-10-01).
  • II-6. documented (records). "Score your product against CRA Annex I security requirements.". Source (accessed 2026-10-01).
  • II-7. documented (records). "Score your product against CRA Annex I security requirements.". Source (accessed 2026-10-01).
  • II-8. documented (records). "Score your product against CRA Annex I security requirements.". Source (accessed 2026-10-01).

CVD Portal​

  • I-1. documented (records). "A 22-requirement self-assessment covering the overarching Annex I Part I(1) requirement". Source (accessed 2026-10-01).
  • I-2a. documented (verifies). "supply-chain scan finding a critical, high-severity or actively exploited (KEV) vulnerability in an SBOM". Source (accessed 2026-10-01).
  • I-2b. documented (records). "You can document secure default testing results, anti-rollback checks, and reset-mechanism validation". Source (accessed 2026-10-01).
  • I-2c. documented (records). "for each row you record evidence, an owner, a due date, a sign-off". Source (accessed 2026-10-01).
  • I-2d. documented (records). "for each row you record evidence, an owner, a due date, a sign-off". Source (accessed 2026-10-01).
  • I-2e. documented (records). "for each row you record evidence, an owner, a due date, a sign-off". Source (accessed 2026-10-01).
  • I-2f. documented (records). "for each row you record evidence, an owner, a due date, a sign-off". Source (accessed 2026-10-01).
  • I-2g. documented (records). "for each row you record evidence, an owner, a due date, a sign-off". Source (accessed 2026-10-01).
  • I-2h. documented (records). "for each row you record evidence, an owner, a due date, a sign-off". Source (accessed 2026-10-01).
  • I-2i. documented (records). "for each row you record evidence, an owner, a due date, a sign-off". Source (accessed 2026-10-01).
  • I-2j. documented (records). "for each row you record evidence, an owner, a due date, a sign-off". Source (accessed 2026-10-01).
  • I-2k. documented (records). "for each row you record evidence, an owner, a due date, a sign-off". Source (accessed 2026-10-01).
  • I-2l. documented (records). "for each row you record evidence, an owner, a due date, a sign-off". Source (accessed 2026-10-01).
  • I-2m. documented (drafts). "Policy library provides standardized user instructions for factory resets, data export, and secure disposal.". Source (accessed 2026-10-01).
  • II-1. documented (records). "Store software bills of materials at Settings → SBOM". Source (accessed 2026-10-01).
  • II-2. documented (records). "formally record their chosen remediation strategy for every validated vulnerability". Source (accessed 2026-10-01).
  • II-3. documented (records). "for each row you record evidence, an owner, a due date, a sign-off". Source (accessed 2026-10-01).
  • II-4. documented (produces). "Export advisories in CSAF (Common Security Advisory Framework) format from a submission". Source (accessed 2026-10-01).
  • II-5. documented (operates). "It gives your company a branded, public vulnerability disclosure portal". Source (accessed 2026-10-01).
  • II-6. documented (produces, operates). "Your portal publishes a valid RFC 9116 file at https://<your-slug>.cvdportal.com/.well-known/security.txt with no setup". Source (accessed 2026-10-01).
  • II-7. documented (records). "CVD Portal supports recording cryptographic hashes (SHA-256) and PGP signatures for published software update packages.". Source (accessed 2026-10-01).
  • II-8. documented (records, operates). "drafting, reviewing, and publishing comprehensive security advisories that meet the transparency requirements". Source (accessed 2026-10-01).

Cycode​

  • I-1. not_documented. Source (accessed 2026-10-01).
  • I-2a. documented (verifies). "With enterprise SCA tools from Cycode, you can prioritize exploitable vulnerabilities". Source (accessed 2026-10-01).
  • I-2b. not_documented. Source (accessed 2026-10-01).
  • I-2c. not_documented. Source (accessed 2026-10-01).
  • I-2d. documented (verifies). "Identify secrets across the SDLC". Source (accessed 2026-10-01).
  • I-2e. not_documented. Source (accessed 2026-10-01).
  • I-2f. not_documented. Source (accessed 2026-10-01).
  • I-2g. not_documented. Source (accessed 2026-10-01).
  • I-2h. not_documented. Source (accessed 2026-10-01).
  • I-2i. not_documented. Source (accessed 2026-10-01).
  • I-2j. not_documented. Source (accessed 2026-10-01).
  • I-2k. not_documented. Source (accessed 2026-10-01).
  • I-2l. not_documented. Source (accessed 2026-10-01).
  • I-2m. not_documented. Source (accessed 2026-10-01).
  • II-1. documented (produces). "Using the Cycode SCA scanner, you always maintain an up-to-date software bill of materials". Source (accessed 2026-10-01).
  • II-2. documented (drafts). "Generates PR-ready fixes with reasoning". Source (accessed 2026-10-01).
  • II-3. documented (verifies). "scan that runs against the full codebase during CI builds". Source (accessed 2026-10-01).
  • II-4. not_documented. Source (accessed 2026-10-01).
  • II-5. not_documented. Source (accessed 2026-10-01).
  • II-6. not_documented. Source (accessed 2026-10-01).
  • II-7. not_documented. Source (accessed 2026-10-01).
  • II-8. not_documented. Source (accessed 2026-10-01).

Drata​

  • I-1. documented (records). "Use requirements built around CRA, with mapped controls and evidence workflows". Source (accessed 2026-10-01).
  • I-2a. documented (records). "Use requirements built around CRA, with mapped controls and evidence workflows". Source (accessed 2026-10-01).
  • I-2b. documented (records). "Use requirements built around CRA, with mapped controls and evidence workflows". Source (accessed 2026-10-01).
  • I-2c. documented (records). "Use requirements built around CRA, with mapped controls and evidence workflows". Source (accessed 2026-10-01).
  • I-2d. documented (records). "Use requirements built around CRA, with mapped controls and evidence workflows". Source (accessed 2026-10-01).
  • I-2e. documented (records). "Use requirements built around CRA, with mapped controls and evidence workflows". Source (accessed 2026-10-01).
  • I-2f. documented (records). "Use requirements built around CRA, with mapped controls and evidence workflows". Source (accessed 2026-10-01).
  • I-2g. documented (records). "Use requirements built around CRA, with mapped controls and evidence workflows". Source (accessed 2026-10-01).
  • I-2h. documented (records). "Use requirements built around CRA, with mapped controls and evidence workflows". Source (accessed 2026-10-01).
  • I-2i. documented (records). "Use requirements built around CRA, with mapped controls and evidence workflows". Source (accessed 2026-10-01).
  • I-2j. documented (records). "Use requirements built around CRA, with mapped controls and evidence workflows". Source (accessed 2026-10-01).
  • I-2k. documented (records). "Use requirements built around CRA, with mapped controls and evidence workflows". Source (accessed 2026-10-01).
  • I-2l. documented (records). "Use requirements built around CRA, with mapped controls and evidence workflows". Source (accessed 2026-10-01).
  • I-2m. documented (records). "Use requirements built around CRA, with mapped controls and evidence workflows". Source (accessed 2026-10-01).
  • II-1. documented (records). "Use requirements built around CRA, with mapped controls and evidence workflows". Source (accessed 2026-10-01).
  • II-2. documented (records). "Identify, triage, document, and remediate vulnerabilities affecting in-scope products". Source (accessed 2026-10-01).
  • II-3. documented (records). "Use requirements built around CRA, with mapped controls and evidence workflows". Source (accessed 2026-10-01).
  • II-4. documented (records). "Use requirements built around CRA, with mapped controls and evidence workflows". Source (accessed 2026-10-01).
  • II-5. documented (records). "Use requirements built around CRA, with mapped controls and evidence workflows". Source (accessed 2026-10-01).
  • II-6. documented (records). "Use requirements built around CRA, with mapped controls and evidence workflows". Source (accessed 2026-10-01).
  • II-7. documented (records). "Use requirements built around CRA, with mapped controls and evidence workflows". Source (accessed 2026-10-01).
  • II-8. documented (records). "Use requirements built around CRA, with mapped controls and evidence workflows". Source (accessed 2026-10-01).

HackerOne​

  • I-1. not_documented. Source (accessed 2026-10-01).
  • I-2a. not_documented. Source (accessed 2026-10-01).
  • I-2b. not_documented. Source (accessed 2026-10-01).
  • I-2c. not_documented. Source (accessed 2026-10-01).
  • I-2d. not_documented. Source (accessed 2026-10-01).
  • I-2e. not_documented. Source (accessed 2026-10-01).
  • I-2f. not_documented. Source (accessed 2026-10-01).
  • I-2g. not_documented. Source (accessed 2026-10-01).
  • I-2h. not_documented. Source (accessed 2026-10-01).
  • I-2i. not_documented. Source (accessed 2026-10-01).
  • I-2j. not_documented. Source (accessed 2026-10-01).
  • I-2k. not_documented. Source (accessed 2026-10-01).
  • I-2l. not_documented. Source (accessed 2026-10-01).
  • I-2m. not_documented. Source (accessed 2026-10-01).
  • II-1. not_documented. Source (accessed 2026-10-01).
  • II-2. documented (records). "on one platform that takes you from disclosure to fix.". Source (accessed 2026-10-01).
  • II-3. documented (verifies). "Validation that runs between audits and complements your existing testing.". Source (accessed 2026-10-01).
  • II-4. documented (operates). "HackerOne will automatically assign a CVE ID and publish it to MITRE". Source (accessed 2026-10-01).
  • II-5. documented (operates). "Your always-on vulnerability disclosure program". Source (accessed 2026-10-01).
  • II-6. documented (operates). "Establish a direct channel for external parties to report discovered vulnerabilities". Source (accessed 2026-10-01).
  • II-7. not_documented. Source (accessed 2026-10-01).
  • II-8. not_documented. Source (accessed 2026-10-01).

Ketryx​

  • I-1. documented (records). "Ketryx provides a unified environment for the entire design control and risk management workflow". Source (accessed 2026-10-01).
  • I-2a. documented (verifies). "Continuous GHSA and NVD monitoring with automatic Vulnerability Advisory generation for affected dependencies". Source (accessed 2026-10-01).
  • I-2b. not_documented. Source (accessed 2026-10-01).
  • I-2c. not_documented. Source (accessed 2026-10-01).
  • I-2d. not_documented. Source (accessed 2026-10-01).
  • I-2e. not_documented. Source (accessed 2026-10-01).
  • I-2f. not_documented. Source (accessed 2026-10-01).
  • I-2g. not_documented. Source (accessed 2026-10-01).
  • I-2h. not_documented. Source (accessed 2026-10-01).
  • I-2i. not_documented. Source (accessed 2026-10-01).
  • I-2j. not_documented. Source (accessed 2026-10-01).
  • I-2k. not_documented. Source (accessed 2026-10-01).
  • I-2l. not_documented. Source (accessed 2026-10-01).
  • I-2m. not_documented. Source (accessed 2026-10-01).
  • II-1. documented (produces). "Generate and maintain machine-readable SBOMs automatically from connected Git repositories.". Source (accessed 2026-10-01).
  • II-2. documented (records). "Ketryx provides an end-to-end vulnerability management workflow". Source (accessed 2026-10-01).
  • II-3. documented (records). "Automatically trace automated tests in Git to requirements in Jira.". Source (accessed 2026-10-01).
  • II-4. documented (produces). "Continuous GHSA and NVD monitoring with automatic Vulnerability Advisory generation for affected dependencies". Source (accessed 2026-10-01).
  • II-5. not_documented. Source (accessed 2026-10-01).
  • II-6. not_documented. Source (accessed 2026-10-01).
  • II-7. not_documented. Source (accessed 2026-10-01).
  • II-8. not_documented. Source (accessed 2026-10-01).

Kunnus​

  • I-1. documented (records). "Appropriate level of cybersecurity based on the risks (security by design) Assessment & evidence". Source (accessed 2026-10-01).
  • I-2a. documented (verifies). "SBOM-based matching against vulnerability databases before and after release.". Source (accessed 2026-10-01).
  • I-2b. documented (records). "No. 2(b) Secure-by-default configuration and reset capability Assessment & evidence". Source (accessed 2026-10-01).
  • I-2c. documented (records). "Update capability is assessed; the update process per product is documented and evidenced.". Source (accessed 2026-10-01).
  • I-2d. documented (records). "Protection from unauthorised access (authentication, identity and access management) Assessment & evidence". Source (accessed 2026-10-01).
  • I-2e. documented (records). "No. 2(e) Confidentiality of stored, transmitted and processed data (encryption) Assessment & evidence". Source (accessed 2026-10-01).
  • I-2f. documented (records). "No. 2(f) Integrity of data, commands, programs and configuration Assessment & evidence". Source (accessed 2026-10-01).
  • I-2g. documented (records). "Data minimisation: processing only data necessary for the intended purpose Assessment & evidence". Source (accessed 2026-10-01).
  • I-2h. documented (records). "Availability of essential functions, incl. after incidents (DoS resilience) Assessment & evidence". Source (accessed 2026-10-01).
  • I-2i. documented (records). "Minimising negative impact on services provided by other devices or networks Assessment & evidence". Source (accessed 2026-10-01).
  • I-2j. documented (records). "No. 2(j) Limited attack surfaces, including external interfaces Assessment & evidence". Source (accessed 2026-10-01).
  • I-2k. documented (records). "No. 2(k) Reducing the impact of incidents (exploitation mitigation) Assessment & evidence". Source (accessed 2026-10-01).
  • I-2l. documented (records). "Recording and monitoring of security-relevant internal activity (with opt-out) Assessment & evidence". Source (accessed 2026-10-01).
  • I-2m. documented (records). "Secure and easy deletion and secure transfer of data and settings Assessment & evidence". Source (accessed 2026-10-01).
  • II-1. documented (produces, records). "SBOM generation and import (multiple formats), dependency tracking across all products and versions.". Source (accessed 2026-10-01).
  • II-2. documented (records). "Triage, prioritisation and status tracking to resolution in the platform". Source (accessed 2026-10-01).
  • II-3. documented (verifies). "Continuous vulnerability monitoring plus CI scans with the open-source kunnus-scanner". Source (accessed 2026-10-01).
  • II-4. documented (produces). "The security advisory can be created straight from the case — in CSAF format". Source (accessed 2026-10-01).
  • II-5. documented (drafts, records). "The CVD policy is created in the platform itself: adapt the policy-library template". Source (accessed 2026-10-01).
  • II-6. documented (operates). "External reporters submit vulnerabilities via a shareable link, no account needed.". Source (accessed 2026-10-01).
  • II-7. documented (records). "No. 7 Mechanisms for secure distribution of updates Assessment & evidence". Source (accessed 2026-10-01).
  • II-8. documented (records). "disseminated without delay and free of charge, with advisories for users Assessment & evidence". Source (accessed 2026-10-01).

ONEKEY​

  • I-1. documented (records). "The tool guides you through each provision and points out gaps or potential violations.". Source (accessed 2026-10-01).
  • I-2a. documented (verifies). "Let our platform detect and prioritize any known or unknown firmware vulnerabilities for you.". Source (accessed 2026-10-01).
  • I-2b. documented (records). "The tool guides you through each provision and points out gaps or potential violations.". Source (accessed 2026-10-01).
  • I-2c. documented (records). "The tool guides you through each provision and points out gaps or potential violations.". Source (accessed 2026-10-01).
  • I-2d. documented (verifies). "Code analysis separately finds hardcoded credentials, weak crypto and injection patterns.". Source (accessed 2026-10-01).
  • I-2e. documented (verifies). "Code analysis separately finds hardcoded credentials, weak crypto and injection patterns.". Source (accessed 2026-10-01).
  • I-2f. documented (records). "The tool guides you through each provision and points out gaps or potential violations.". Source (accessed 2026-10-01).
  • I-2g. documented (records). "The tool guides you through each provision and points out gaps or potential violations.". Source (accessed 2026-10-01).
  • I-2h. documented (records). "The tool guides you through each provision and points out gaps or potential violations.". Source (accessed 2026-10-01).
  • I-2i. documented (records). "The tool guides you through each provision and points out gaps or potential violations.". Source (accessed 2026-10-01).
  • I-2j. documented (records). "The tool guides you through each provision and points out gaps or potential violations.". Source (accessed 2026-10-01).
  • I-2k. documented (verifies). "checks binary hardening, such as missing stack canaries, NX stack or RELRO". Source (accessed 2026-10-01).
  • I-2l. documented (records). "The tool guides you through each provision and points out gaps or potential violations.". Source (accessed 2026-10-01).
  • I-2m. documented (records). "The tool guides you through each provision and points out gaps or potential violations.". Source (accessed 2026-10-01).
  • II-1. documented (produces). "ONEKEY automatically generates an SBOM from the firmware image during analysis.". Source (accessed 2026-10-01).
  • II-2. documented (records). "Triage and evaluate security issues and CVEs using CVSS Environmental scores". Source (accessed 2026-10-01).
  • II-3. documented (verifies). "Every build can be checked automatically through CI/CD.". Source (accessed 2026-10-01).
  • II-4. documented (produces). "Exporting VEX information can, for example, support compliance with certain cybersecurity regulations". Source (accessed 2026-10-01).
  • II-5. documented (records). "The tool guides you through each provision and points out gaps or potential violations.". Source (accessed 2026-10-01).
  • II-6. documented (records). "The tool guides you through each provision and points out gaps or potential violations.". Source (accessed 2026-10-01).
  • II-7. documented (records). "The tool guides you through each provision and points out gaps or potential violations.". Source (accessed 2026-10-01).
  • II-8. documented (records). "The tool guides you through each provision and points out gaps or potential violations.". Source (accessed 2026-10-01).

Vanta​

  • I-1. not_documented. Source (accessed 2026-10-01).
  • I-2a. not_documented. Source (accessed 2026-10-01).
  • I-2b. not_documented. Source (accessed 2026-10-01).
  • I-2c. not_documented. Source (accessed 2026-10-01).
  • I-2d. not_documented. Source (accessed 2026-10-01).
  • I-2e. not_documented. Source (accessed 2026-10-01).
  • I-2f. not_documented. Source (accessed 2026-10-01).
  • I-2g. not_documented. Source (accessed 2026-10-01).
  • I-2h. not_documented. Source (accessed 2026-10-01).
  • I-2i. not_documented. Source (accessed 2026-10-01).
  • I-2j. not_documented. Source (accessed 2026-10-01).
  • I-2k. not_documented. Source (accessed 2026-10-01).
  • I-2l. not_documented. Source (accessed 2026-10-01).
  • I-2m. not_documented. Source (accessed 2026-10-01).
  • II-1. not_documented. Source (accessed 2026-10-01).
  • II-2. not_documented. Source (accessed 2026-10-01).
  • II-3. not_documented. Source (accessed 2026-10-01).
  • II-4. not_documented. Source (accessed 2026-10-01).
  • II-5. not_documented. Source (accessed 2026-10-01).
  • II-6. not_documented. Source (accessed 2026-10-01).
  • II-7. not_documented. Source (accessed 2026-10-01).
  • II-8. not_documented. Source (accessed 2026-10-01).

Venvera​

  • I-1. documented (records). "documented per-product risk assessment that Venvera holds alongside the controls". Source (accessed 2026-10-01).
  • I-2a. documented (records). "controls with evidence: a secure-by-default configuration, no known exploitable vulnerabilities". Source (accessed 2026-10-01).
  • I-2b. documented (records). "controls with evidence: a secure-by-default configuration, no known exploitable vulnerabilities". Source (accessed 2026-10-01).
  • I-2c. documented (records). "a limited attack surface, and the ability to be updated.". Source (accessed 2026-10-01).
  • I-2d. documented (records). "protection against unauthorised access, confidentiality and integrity of data, data minimisation". Source (accessed 2026-10-01).
  • I-2e. documented (records). "protection against unauthorised access, confidentiality and integrity of data, data minimisation". Source (accessed 2026-10-01).
  • I-2f. documented (records). "protection against unauthorised access, confidentiality and integrity of data, data minimisation". Source (accessed 2026-10-01).
  • I-2g. documented (records). "protection against unauthorised access, confidentiality and integrity of data, data minimisation". Source (accessed 2026-10-01).
  • I-2h. documented (records). "data minimisation, availability and denial-of-service resilience, a limited attack surface". Source (accessed 2026-10-01).
  • I-2i. documented (records). "Venvera tracks the Annex I Part I requirements as controls with evidence". Source (accessed 2026-10-01).
  • I-2j. documented (records). "data minimisation, availability and denial-of-service resilience, a limited attack surface". Source (accessed 2026-10-01).
  • I-2k. documented (records). "Venvera tracks the Annex I Part I requirements as controls with evidence". Source (accessed 2026-10-01).
  • I-2l. documented (records). "Venvera tracks the Annex I Part I requirements as controls with evidence". Source (accessed 2026-10-01).
  • I-2m. documented (records). "Venvera tracks the Annex I Part I requirements as controls with evidence". Source (accessed 2026-10-01).
  • II-1. documented (records). "Venvera tracks the vulnerability-handling machinery: a software bill of materials in a machine-readable format". Source (accessed 2026-10-01).
  • II-2. documented (records). "a published coordinated vulnerability disclosure policy, a handling process that remediates without delay". Source (accessed 2026-10-01).
  • II-3. documented (records). "a handling process that remediates without delay and ships advisories, regular security testing". Source (accessed 2026-10-01).
  • II-4. documented (records). "a handling process that remediates without delay and ships advisories, regular security testing". Source (accessed 2026-10-01).
  • II-5. documented (records). "a published coordinated vulnerability disclosure policy, a handling process that remediates without delay". Source (accessed 2026-10-01).
  • II-6. documented (records). "Venvera tracks the vulnerability-handling machinery". Source (accessed 2026-10-01).
  • II-7. documented (records). "Venvera tracks the vulnerability-handling machinery". Source (accessed 2026-10-01).
  • II-8. documented (records). "Vulnerability handling with advisories and timely security updates". Source (accessed 2026-10-01).

How the register works​

The register uses two values. "Documented" means the vendor states support on a domain it owns. "Not documented" means the search found no such statement on the date shown. Review sites, analyst reports, comparison pages and model answers are never sources. A generic sentence that fits any checklist row supports "records" only and carries an asterisk. Each cell quotes at most 15 words.

Disputes​

A vendor can ask for a correction at research@portaregulus.com. Send the public URL that documents the requirement. The corrected cell ships with a dated entry in the change log.

Who publishes this​

Porta Regulus B.V. publishes this register and sells CVD Portal, one of the tools in it. Porta Regulus B.V. also publishes a separate weighted ranking of CRA software on cradata.eu and cvdportal.com. The register does not use the scores of that ranking.

Download and cite​

CVD Portal, "CRA vendor register", 2026-10-01. https://cradata.eu/register (CC BY 4.0)