-
Notifications
You must be signed in to change notification settings - Fork 181
/
cra-proposal-annexes.yaml
1571 lines (1570 loc) · 78.9 KB
/
cra-proposal-annexes.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
urn: urn:intuitem:risk:library:cra-proposal-annexes
locale: en
ref_id: CRA-proposal-annexes
name: Cyber Resilience Act
description: 'ANNEXES to the PROPOSAL FOR A REGULATION OF THE EUROPEAN PARLIAMENT
AND OF THE COUNCIL on horizontal cybersecurity requirements for products with digital
elements and amending Regulation (EU) 2019/1020
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52022PC0454'
copyright: European Union law
version: 1
provider: EU
packager: intuitem
objects:
framework:
urn: urn:intuitem:risk:framework:cra-proposal-annexes
ref_id: CRA-proposal-annexes
name: Cyber Resilience Act
description: ANNEXES to the PROPOSAL FOR A REGULATION OF THE EUROPEAN PARLIAMENT
AND OF THE COUNCIL on horizontal cybersecurity requirements for products with
digital elements and amending Regulation (EU) 2019/1020
requirement_nodes:
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1
assessable: false
depth: 1
ref_id: '1'
name: ANNEX I
description: ESSENTIAL CYBERSECURITY REQUIREMENTS
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.1
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1
ref_id: '1.1'
name: Security requirements relating to the properties of products with digital
elements
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.1.1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.1
ref_id: 1.1.1
description: Products with digital elements shall be designed, developed and
produced in such a way that they ensure an appropriate level of cybersecurity
based on the risks;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.1.2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.1
ref_id: 1.1.2
description: Products with digital elements shall be delivered without any known
exploitable vulnerabilities;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.1.3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.1
ref_id: 1.1.3
description: 'On the basis of the risk assessment referred to in Article 10(2)
and where applicable, products with digital elements shall:'
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.1.3.a
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.1.3
ref_id: 1.1.3.a
description: be delivered with a secure by default configuration, including
the possibility to reset the product to its original state;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.1.3.b
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.1.3
ref_id: 1.1.3.b
description: ensure protection from unauthorised access by appropriate control
mechanisms, including but not limited to authentication, identity or access
management systems;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.1.3.c
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.1.3
ref_id: 1.1.3.c
description: protect the confidentiality of stored, transmitted or otherwise
processed data, personal or other, such as by encrypting relevant data at
rest or in transit by state of the art mechanisms;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.1.3.d
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.1.3
ref_id: 1.1.3.d
description: protect the integrity of stored, transmitted or otherwise processed
data, personal or other, commands, programs and configuration against any
manipulation or modification not authorised by the user, as well as report
on corruptions;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.1.3.e
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.1.3
ref_id: 1.1.3.e
description: "process only data, personal or other, that are adequate, relevant\
\ and limited to what is necessary in relation to the intended use of the\
\ product (\u2018minimisation of data\u2019); "
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.1.3.f
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.1.3
ref_id: 1.1.3.f
description: protect the availability of essential functions, including the
resilience against and mitigation of denial of service attacks;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.1.3.g
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.1.3
ref_id: 1.1.3.g
description: minimise their own negative impact on the availability of services
provided by other devices or networks;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.1.3.h
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.1.3
ref_id: 1.1.3.h
description: be designed, developed and produced to limit attack surfaces, including
external interfaces;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.1.3.i
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.1.3
ref_id: 1.1.3.i
description: be designed, developed and produced to reduce the impact of an
incident using appropriate exploitation mitigation mechanisms and techniques;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.1.3.j
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.1.3
ref_id: 1.1.3.j
description: provide security related information by recording and/or monitoring
relevant internal activity, including the access to or modification of data,
services or functions;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.1.3.k
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.1.3
ref_id: 1.1.3.k
description: ensure that vulnerabilities can be addressed through security updates,
including, where applicable, through automatic updates and the notification
of available updates to users.
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.2
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1
ref_id: '1.2'
name: "Vulnerability\_handling\_requirements"
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node19
assessable: false
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.2
description: 'Manufacturers of the products with digital elements shall:'
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.2.1
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node19
ref_id: 1.2.1
description: identify and document vulnerabilities and components contained
in the product, including by drawing up a software bill of materials in a
commonly used and machine-readable format covering at the very least the top-level
dependencies of the product;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.2.2
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node19
ref_id: 1.2.2
description: in relation to the risks posed to the products with digital elements,
address and remediate vulnerabilities without delay, including by providing
security updates;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.2.3
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node19
ref_id: 1.2.3
description: apply effective and regular tests and reviews of the security of
the product with digital elements;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.2.4
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node19
ref_id: 1.2.4
description: once a security update has been made available, publically disclose
information about fixed vulnerabilities, including a description of the vulnerabilities,
information allowing users to identify the product with digital elements affected,
the impacts of the vulnerabilities, their severity and information helping
users to remediate the vulnerabilities;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.2.5
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node19
ref_id: 1.2.5
description: put in place and enforce a policy on coordinated vulnerability
disclosure;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.2.6
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node19
ref_id: 1.2.6
description: take measures to facilitate the sharing of information about potential
vulnerabilities in their product with digital elements as well as in third
party components contained in that product, including by providing a contact
address for the reporting of the vulnerabilities discovered in the product
with digital elements;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.2.7
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node19
ref_id: 1.2.7
description: provide for mechanisms to securely distribute updates for products
with digital elements to ensure that exploitable vulnerabilities are fixed
or mitigated in a timely manner;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:1.2.8
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node19
ref_id: 1.2.8
description: ensure that, where security patches or updates are available to
address identified security issues, they are disseminated without delay and
free of charge, accompanied by advisory messages providing users with the
relevant information, including on potential action to be taken.
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:2
assessable: false
depth: 1
ref_id: '2'
name: ANNEX II
description: INFORMATION AND INSTRUCTIONS TO THE USER
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node29
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:2
description: 'As a minimum, the product with digital elements shall be accompanied
by:'
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:2.1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node29
ref_id: '2.1'
description: the name, registered trade name or registered trade mark of the
manufacturer, and the postal address and the email address at which the manufacturer
can be contacted, on the product or, where that is not possible, on its packaging
or in a document accompanying the product;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:2.2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node29
ref_id: '2.2'
description: the point of contact where information about cybersecurity vulnerabilities
of the product can be reported and received;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:2.3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node29
ref_id: '2.3'
description: the correct identification of the type, batch, version or serial
number or other element allowing the identification of the product and the
corresponding instructions and user information;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:2.4
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node29
ref_id: '2.4'
description: "the intended use, including the security environment provided\
\ by the manufacturer, as well as the product\u2019s essential functionalities\
\ and information about the security properties;"
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:2.5
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node29
ref_id: '2.5'
description: 'any known or foreseeable circumstance, related to the use of the
product with digital elements in accordance with its intended purpose or under
conditions of reasonably foreseeable misuse, which may lead to significant
cybersecurity risks; '
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:2.6
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node29
ref_id: '2.6'
description: if and, where applicable, where the software bill of materials
can be accessed;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:2.7
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node29
ref_id: '2.7'
description: 'where applicable, the internet address at which the EU declaration
of conformity can be accessed; '
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:2.8
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node29
ref_id: '2.8'
description: 'the type of technical security support offered by the manufacturer
and until when it will be provided, at the very least until when users can
expect to receive security updates; '
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:2.9
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node29
ref_id: '2.9'
description: 'detailed instructions or an internet address referring to such
detailed instructions and information on:'
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:2.9.a
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:2.9
ref_id: 2.9.a
description: the necessary measures during initial commissioning and throughout
the lifetime of the product to ensure its secure use;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:2.9.b
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:2.9
ref_id: 2.9.b
description: how changes to the product can affect the security of data;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:2.9.c
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:2.9
ref_id: 2.9.c
description: how security-relevant updates can be installed;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:2.9.d
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:2.9
ref_id: 2.9.d
description: the secure decommissioning of the product, including information
on how user data can be securely removed.
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3
assessable: false
depth: 1
ref_id: '3'
name: ANNEX III
description: CRITICAL PRODUCTS WITH DIGITAL ELEMENTS
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3
ref_id: '3.1'
name: Class I
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1.1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1
ref_id: 3.1.1
description: Identity management systems software and privileged access management
software;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1.2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1
ref_id: 3.1.2
description: Standalone and embedded browsers;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1.3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1
ref_id: 3.1.3
description: Password managers;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1.4
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1
ref_id: 3.1.4
description: Software that searches for, removes, or quarantines malicious software;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1.5
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1
ref_id: 3.1.5
description: Products with digital elements with the function of virtual private
network (VPN);
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1.6
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1
ref_id: 3.1.6
description: Network management systems;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1.7
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1
ref_id: 3.1.7
description: Network configuration management tools;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1.8
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1
ref_id: 3.1.8
description: Network traffic monitoring systems;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1.9
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1
ref_id: 3.1.9
description: Management of network resources;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1.10
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1
ref_id: 3.1.10
description: Security information and event management (SIEM) systems;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1.11
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1
ref_id: 3.1.11
description: Update/patch management, including boot managers;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1.12
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1
ref_id: 3.1.12
description: Application configuration management systems;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1.13
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1
ref_id: 3.1.13
description: Remote access/sharing software;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1.14
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1
ref_id: 3.1.14
description: Mobile device management software;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1.15
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1
ref_id: 3.1.15
description: Physical network interfaces;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1.16
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1
ref_id: 3.1.16
description: Operating systems not covered by class II;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1.17
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1
ref_id: 3.1.17
description: Firewalls, intrusion detection and/or prevention systems not covered
by class II;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1.18
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1
ref_id: 3.1.18
description: Routers, modems intended for the connection to the internet, and
switches, not covered by class II;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1.19
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1
ref_id: 3.1.19
description: Microprocessors not covered by class II;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1.20
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1
ref_id: 3.1.20
description: Microcontrollers;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1.21
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1
ref_id: 3.1.21
description: Application specific integrated circuits (ASIC) and field-programmable
gate arrays (FPGA) intended for the use by essential entities of the type
referred to in [Annex I to the Directive XXX/XXXX (NIS2)];
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1.22
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1
ref_id: 3.1.22
description: Industrial Automation & Control Systems (IACS) not covered by class
II, such as programmable logic controllers (PLC), distributed control systems
(DCS), computerised numeric controllers for machine tools (CNC) and supervisory
control and data acquisition systems (SCADA);
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1.23
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.1
ref_id: 3.1.23
description: Industrial Internet of Things not covered by class II.
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.2
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3
ref_id: '3.2'
name: Class II
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.2.1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.2
ref_id: 3.2.1
description: Operating systems for servers, desktops, and mobile devices;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.2.2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.2
ref_id: 3.2.2
description: Hypervisors and container runtime systems that support virtualised
execution of operating systems and similar environments;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.2.3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.2
ref_id: 3.2.3
description: Public key infrastructure and digital certificate issuers;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.2.4
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.2
ref_id: 3.2.4
description: Firewalls, intrusion detection and/or prevention systems intended
for industrial use;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.2.5
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.2
ref_id: 3.2.5
description: General purpose microprocessors;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.2.6
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.2
ref_id: 3.2.6
description: Microprocessors intended for integration in programmable logic
controllers and secure elements;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.2.7
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.2
ref_id: 3.2.7
description: Routers, modems intended for the connection to the internet, and
switches, intended for industrial use;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.2.8
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.2
ref_id: 3.2.8
description: Secure elements;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.2.9
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.2
ref_id: 3.2.9
description: Hardware Security Modules (HSMs);
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.2.10
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.2
ref_id: 3.2.10
description: Secure cryptoprocessors;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.2.11
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.2
ref_id: 3.2.11
description: Smartcards, smartcard readers and tokens;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.2.12
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.2
ref_id: 3.2.12
description: Industrial Automation & Control Systems (IACS) intended for the
use by essential entities of the type referred to in [Annex I to the Directive
XXX/XXXX (NIS2)], such as programmable logic controllers (PLC), distributed
control systems (DCS), computerised numeric controllers for machine tools
(CNC) and supervisory control and data acquisition systems (SCADA);
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.2.13
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.2
ref_id: 3.2.13
description: Industrial Internet of Things devices intended for the use by essential
entities of the type referred to in [Annex I to the Directive XXX/XXXX (NIS2)];
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.2.14
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.2
ref_id: 3.2.14
description: Robot sensing and actuator components and robot controllers;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.2.15
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:3.2
ref_id: 3.2.15
description: Smart meters.
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:4
assessable: false
depth: 1
ref_id: '4'
name: ANNEX IV
description: EU DECLARATION OF CONFORMITY
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node85
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:4
description: 'The EU declaration of conformity referred to in Article 20, shall
contain all of the following information:'
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:4.1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node85
ref_id: '4.1'
description: Name and type and any additional information enabling the unique
identification of the product with digital elements;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:4.2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node85
ref_id: '4.2'
description: 'Name and address of the manufacturer or his authorised representative; '
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:4.3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node85
ref_id: '4.3'
description: 'A statement that the EU declaration of conformity is issued under
the sole responsibility of the provider; '
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:4.4
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node85
ref_id: '4.4'
description: 'Object of the declaration (identification of the product allowing
traceability. It may include a photograph, where appropriate); '
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:4.5
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node85
ref_id: '4.5'
description: A statement that the object of the declaration described above
is in conformity with the relevant Union harmonisation legislation;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:4.6
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node85
ref_id: '4.6'
description: 'References to any relevant harmonised standards used or any other
common specification or cybersecurity certification in relation to which conformity
is declared; '
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:4.7
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node85
ref_id: '4.7'
description: 'Where applicable, the name and number of the notified body, a
description of the conformity assessment procedure performed and identification
of the certificate issued; '
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:4.8
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node85
ref_id: '4.8'
description: "Additional information: \nSigned for and on behalf of: \n(place\
\ and date of issue): \n(name, function) (signature):"
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:5
assessable: false
depth: 1
ref_id: '5'
name: ANNEX V
description: CONTENTS OF THE TECHNICAL DOCUMENTATION
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node95
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:5
description: 'The technical documentation referred to in Article 23 shall contain
at least the following information, as applicable to the relevant product
with digital elements:'
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:5.1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node95
ref_id: '5.1'
description: 'a general description of the product with digital elements, including: '
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:5.1.a
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:5.1
ref_id: 5.1.a
description: 'its intended purpose; '
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:5.1.b
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:5.1
ref_id: 5.1.b
description: 'versions of software affecting compliance with essential requirements; '
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:5.1.c
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:5.1
ref_id: 5.1.c
description: 'where the product with digital elements is a hardware product,
photographs or illustrations showing external features, marking and internal
layout; '
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:5.1.d
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:5.1
ref_id: 5.1.d
description: user information and instructions as set out in Annex II;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:5.2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node95
ref_id: '5.2'
description: 'a description of the design, development and production of the
product and vulnerability handling processes, including: '
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:5.2.a
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:5.2
ref_id: 5.2.a
description: complete information on the design and development of the product
with digital elements, including, where applicable, drawings and schemes and/or
a description of the system architecture explaining how software components
build on or feed into each other and integrate into the overall processing;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:5.2.b
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:5.2
ref_id: 5.2.b
description: 'complete information and specifications of the vulnerability handling
processes put in place by the manufacturer, including the software bill of
materials, the coordinated vulnerability disclosure policy, evidence of the
provision of a contact address for the reporting of the vulnerabilities and
a description of the technical solutions chosen for the secure distribution
of updates; '
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:5.2.c
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:5.2
ref_id: 5.2.c
description: 'complete information and specifications of the production and
monitoring processes of the product with digital elements and the validation
of these processes. '
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:5.3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node95
ref_id: '5.3'
description: 'an assessment of the cybersecurity risks against which the product
with digital elements is designed, developed, produced, delivered and maintained
as laid down in Article 10 of this Regulation; '
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:5.4
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node95
ref_id: '5.4'
description: 'a list of the harmonised standards applied in full or in part
the references of which have been published in the Official Journal of the
European Union, common specifications as set out in Article 19 of this Regulation
or cybersecurity certification schemes under Regulation (EU) 2019/881 pursuant
to Article 18(3), and, where those harmonised standards, common specifications
or cybersecurity certification schemes have not been applied, descriptions
of the solutions adopted to meet the essential requirements set out in Sections
1 and 2 of Annex I, including a list of other relevant technical specifications
applied. In the event of partly applied harmonised standards, common specifications
or cybersecurity certifications, the technical documentation shall specify
the parts which have been applied; '
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:5.5
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node95
ref_id: '5.5'
description: reports of the tests carried out to verify the conformity of the
product and of the vulnerability handling processes with the applicable essential
requirements as set out in Sections 1 and 2 of Annex I;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:5.6
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node95
ref_id: '5.6'
description: a copy of the EU declaration of conformity;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:5.7
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node95
ref_id: '5.7'
description: 'where applicable, the software bill of materials as defined in
Article 3, point (36), further to a reasoned request from a market surveillance
authority provided that it is necessary in order for this authority to be
able to check compliance with the essential requirements set out in Annex
I. '
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6
assessable: false
depth: 1
ref_id: '6'
name: ANNEX VI
description: CONFORMITY ASSESSMENT PROCEDURES
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.a
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6
ref_id: 6.A
name: Conformity Assessment procedure based on internal control (based on Module
A)
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.a.1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.a
ref_id: 6.A.1
description: Internal control is the conformity assessment procedure whereby
the manufacturer fulfils the obligations laid down in points 2, 3 and 4, and
ensures and declares on its sole responsibility that the products with digital
elements satisfy all the essential requirements set out in Section 1 of Annex
I and the manufacturer meets the essential requirements set out in Section
2 of Annex I.
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.a.2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.a
ref_id: 6.A.2
description: 'The manufacturer shall draw up the technical documentation described
in Annex V. '
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.a.3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.a
ref_id: 6.A.3
name: Design, development, production and vulnerability handling of products
with digital elements
description: 'The manufacturer shall take all measures necessary so that the
design, development, production and vulnerability handling processes and their
monitoring ensure compliance of the manufactured or developed products with
digital elements and of the processes put in place by the manufacturer with
the essential requirements set out in sections 1 and 2 of Annex I. '
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.a.4
assessable: false
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.a
ref_id: 6.A.4
name: Conformity marking and declaration of conformity
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.a.4.1
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.a.4
ref_id: 6.A.4.1
description: The manufacturer shall affix the CE to each individual product
with digital elements that satisfies the applicable requirements of this Regulation.
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.a.4.2
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.a.4
ref_id: 6.A.4.2
description: 'The manufacturer shall draw up a written EU declaration of conformity
for each product with digital elements in accordance with Article 20 and keep
it together with the technical documentation at the disposal of the national
authorities for 10 years after the product with digital elements has been
placed on the market. The EU declaration of conformity shall identify the
product with digital elements for which it has been drawn up. A copy of the
EU declaration of conformity shall be made available to the relevant authorities
upon request. '
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.a.5
assessable: true
depth: 5
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.a.4.2
ref_id: 6.A.5
name: Authorised representatives
description: "The manufacturer\u2019s obligations set out in point 4 may be\
\ fulfilled by his authorised representative, on his behalf and under his\
\ responsibility, provided that they are specified in the mandate."
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.b
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6
ref_id: 6.B
name: EU-type examination (based on Module B)
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.b.1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.b
ref_id: 6.B.1
description: EU-type examination is the part of a conformity assessment procedure
in which a notified body examines the technical design and development of
a product and the vulnerability handling processes put in place by the manufacturer,
and attests that a product with digital elements meets the essential requirements
set out in Section 1 of Annex I and that the manufacturer meets the essential
requirements set out in Section 2 of Annex I.
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.b.2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.b
ref_id: 6.B.2
description: EU-type examination shall be carried out by assessment of the adequacy
of the technical design and development of the product through examination
of the technical documentation and supporting evidence referred to in point
3, plus examination of specimens of one or more critical parts of the product
(combination of production type and design type).
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.b.3
assessable: false
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.b
ref_id: 6.B.3
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node123
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.b.3
description: The manufacturer shall lodge an application for EU-type examination
with a single notified body of his choice.
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node124
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.b.3
description: 'The application shall include:'
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node125
assessable: true
depth: 5
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node124
description: '- the name and address of the manufacturer and, if the application
is lodged by the authorised representative, his name and address as well;'
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node126
assessable: true
depth: 5
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node124
description: '- a written declaration that the same application has not been
lodged with any other notified body; '
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node127
assessable: true
depth: 5
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node124
description: '- the technical documentation, which shall make it possible to
assess the product''s conformity with the applicable essential requirements
as set out in Section 1 of Annex I and the manufacturer''s vulnerability handling
processes set out in Section 2 of Annex I, and shall include an adequate analysis
and assessment of the risk(s). The technical documentation shall specify the
applicable requirements and cover, as far as relevant for the assessment,
the design, manufacture and operation of the product. The technical documentation
shall contain, wherever applicable, at least the elements set out in Annex
V; '
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node128
assessable: true
depth: 5
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:node124
description: '- the supporting evidence for the adequacy of the technical design
and development solutions and vulnerability handling processes. This supporting
evidence shall mention any documents that have been used, in particular where
the relevant harmonised standards and/or technical specifications have not
been applied in full. The supporting evidence shall include, where necessary,
the results of tests carried out by the appropriate laboratory of the manufacturer,
or by another testing laboratory on his behalf and under his responsibility.'
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.b.4
assessable: false
depth: 3
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.b
ref_id: 6.B.4
description: 'The notified body shall: '
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.b.4.1
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.b.4
ref_id: 6.B.4.1
description: examine the technical documentation and supporting evidence to
assess the adequacy of the technical design and development of the product
with the essential requirements set out in Section 1 of Annex I and of the
vulnerability handling processes put in place by the manufacturer with the
essential requirements set out in Section 2 of Annex I;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.b.4.2
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.b.4
ref_id: 6.B.4.2
description: verify that the specimen(s) have been developed or manufactured
in conformity with the technical documentation, and identify the elements
which have been designed and developed in accordance with the applicable provisions
of the relevant harmonised standards and/or technical specifications, as well
as the elements which have been designed and developed without applying the
relevant provisions of those standards;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.b.4.3
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.b.4
ref_id: 6.B.4.3
description: carry out appropriate examinations and tests, or have them carried
out, to check whether, where the manufacturer has chosen to apply the solutions
in the relevant harmonised standards and/or technical specifications for the
requirements set out in Annex I, these have been applied correctly;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.b.4.4
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.b.4
ref_id: 6.B.4.4
description: carry out appropriate examinations and tests, or have them carried
out, to check whether, where the solutions in the relevant harmonised standards
and/or technical specifications for the requirements set out in Annex I have
not been applied, the solutions adopted by the manufacturer meet the corresponding
essential requirements;
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.b.4.5
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.b.4
ref_id: 6.B.4.5
description: agree with the manufacturer on a location where the examinations
and tests will be carried out.
- urn: urn:intuitem:risk:req_node:cra-proposal-annexes:6.b.5