Record the essential requirements and risk assessment

Article 13 asks for a cybersecurity risk assessment that says, requirement by requirement, whether each part of Annex I applies to the product and how it is met. Annex VII puts that into the technical documentation. This is where you write it down; the technical file is drafted from it.

It is your record. Declara does not assess the product and never marks a requirement as met.

Before you start

• A product. The page is per product.
• products.write to edit. Anyone who can read products can view it.

Steps

1. Open the product and, in Conformity assessment, follow Essential requirements and risk assessment. The count beside the link says how many of the 22 requirements carry an answer.
2. Fill in Risk assessment: intended purpose, reasonably foreseeable use, operating environment, what it protects, threats, measures and residual risk. The Regulation fixes what the assessment covers, not the method, so these are free text. Press Save the assessment.
3. Open each requirement under Part I: the product and Part II: handling vulnerabilities:
   • Write How it is met, and optionally where the Evidence lives.
   • For the thirteen Part I(2) requirements only, you can answer It does not apply, and must then say why. Part I(1) and all of Part II apply to every product.
   • Press Save.

What you should see

Each requirement shows Recorded, Not applicable or Not yet recorded. Beside some, What Declara sees reports a fact it holds, such as how many supported versions have an SBOM and their quality score, open alerts for exploited vulnerabilities, whether your disclosure page is published, publicly listed advisories, the support period, or the cryptography the SBOMs declare. These are facts to cite, never a verdict.

Every save is in the audit chain with who made it.

Related

• Draft a product's technical file
• Record a substantial-modification decision