Skip to content

Added EU CRA compliance framework #164

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rajan262 merged 1 commit into from
Sep 1, 2026
Merged

Added EU CRA compliance framework #164

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
114 changes: 114 additions & 0 deletions ak_vendor/compliances/eucra.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,114 @@
from gettext import gettext as _

# Reference: https://eur-lex.europa.eu/eli/reg/2024/2847/oj

data = [
{
"id": "cra_i_2_a",
"code": "Annex I, Part I, point (2)(a)",
"title": _(
"be made available on the market without known exploitable vulnerabilities;"
),
},
{
"id": "cra_i_2_b",
"code": "Annex I, Part I, point (2)(b)",
"title": _(
"be made available on the market with a secure by default configuration, "
"unless otherwise agreed between manufacturer and business user in relation "
"to a tailor-made product with digital elements, including the possibility "
"to reset the product to its original state;"
),
},
{
"id": "cra_i_2_d",
"code": "Annex I, Part I, point (2)(d)",
"title": _(
"ensure protection from unauthorised access by appropriate control "
"mechanisms, including but not limited to authentication, identity or "
"access management systems, and report on possible unauthorised access;"
),
},
{
"id": "cra_i_2_e",
"code": "Annex I, Part I, point (2)(e)",
"title": _(
"protect the confidentiality of stored, transmitted or otherwise processed "
"data, personal or other, such as by encrypting relevant data at rest or in "
"transit by state of the art mechanisms, and by using other technical means;"
),
},
{
"id": "cra_i_2_f",
"code": "Annex I, Part I, point (2)(f)",
"title": _(
"protect the integrity of stored, transmitted or otherwise processed data, "
"personal or other, commands, programs and configuration against any "
"manipulation or modification not authorised by the user, and report on "
"corruptions;"
),
},
{
"id": "cra_i_2_g",
"code": "Annex I, Part I, point (2)(g)",
"title": _(
"process only data, personal or other, that are adequate, relevant and "
"limited to what is necessary in relation to the intended purpose of the "
"product with digital elements (data minimisation);"
),
},
{
"id": "cra_i_2_h",
"code": "Annex I, Part I, point (2)(h)",
"title": _(
"protect the availability of essential and basic functions, also after an "
"incident, including through resilience and mitigation measures against "
"denial-of-service attacks;"
),
},
{
"id": "cra_i_2_j",
"code": "Annex I, Part I, point (2)(j)",
"title": _(
"be designed, developed and produced to limit attack surfaces, including "
"external interfaces;"
),
},
{
"id": "cra_i_2_k",
"code": "Annex I, Part I, point (2)(k)",
"title": _(
"be designed, developed and produced to reduce the impact of an incident "
"using appropriate exploitation mitigation mechanisms and techniques;"
),
},
{
"id": "cra_ii_2",
"code": "Annex I, Part II, point (2)",
"title": _(
"in relation to the risks posed to products with digital elements, address "
"and remediate vulnerabilities without delay, including by providing "
"security updates; where technically feasible, new security updates shall "
"be provided separately from functionality updates;"
),
},
]


class EUCRA:
"""Represents a single EU CRA (Regulation (EU) 2024/2847) annex entry."""

def __init__(self, id, code, title):
self.pk = id
self.id = id
self.code = code
self.title = title

def __str__(self):
return f"{self.id} - {self.code} - {self.title}"

def __repr__(self):
return "<EUCRA: %s>" % self.__str__()


EUCRA_DATA = {d["id"]: EUCRA(**d) for d in data}
87 changes: 81 additions & 6 deletions ak_vendor/locale/ja/LC_MESSAGES/django.po
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ msgid ""
msgstr ""
"Project-Id-Version: Appknox\n"
"Report-Msgid-Bugs-To: \n"
"POT-Creation-Date: 2026-07-21 16:07+0100\n"
"POT-Creation-Date: 2026-08-02 16:01+0530\n"
"Language: ja\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
Expand Down Expand Up @@ -2014,6 +2014,77 @@ msgid ""
"feasible, and penetration testing."
msgstr ""

#: ak_vendor/compliances/eucra.py:10
#, fuzzy
#| msgid "Using Components with Known Vulnerabilities"
msgid ""
"be made available on the market without known exploitable vulnerabilities;"
msgstr "既知の脆弱性を持つコンポーネントの使用"

#: ak_vendor/compliances/eucra.py:17
msgid ""
"be made available on the market with a secure by default configuration, "
"unless otherwise agreed between manufacturer and business user in relation "
"to a tailor-made product with digital elements, including the possibility to "
"reset the product to its original state;"
msgstr ""

#: ak_vendor/compliances/eucra.py:27
msgid ""
"ensure protection from unauthorised access by appropriate control "
"mechanisms, including but not limited to authentication, identity or access "
"management systems, and report on possible unauthorised access;"
msgstr ""

#: ak_vendor/compliances/eucra.py:36
msgid ""
"protect the confidentiality of stored, transmitted or otherwise processed "
"data, personal or other, such as by encrypting relevant data at rest or in "
"transit by state of the art mechanisms, and by using other technical means;"
msgstr ""

#: ak_vendor/compliances/eucra.py:45
msgid ""
"protect the integrity of stored, transmitted or otherwise processed data, "
"personal or other, commands, programs and configuration against any "
"manipulation or modification not authorised by the user, and report on "
"corruptions;"
msgstr ""

#: ak_vendor/compliances/eucra.py:55
msgid ""
"process only data, personal or other, that are adequate, relevant and "
"limited to what is necessary in relation to the intended purpose of the "
"product with digital elements (data minimisation);"
msgstr ""

#: ak_vendor/compliances/eucra.py:64
msgid ""
"protect the availability of essential and basic functions, also after an "
"incident, including through resilience and mitigation measures against "
"denial-of-service attacks;"
msgstr ""

#: ak_vendor/compliances/eucra.py:73
msgid ""
"be designed, developed and produced to limit attack surfaces, including "
"external interfaces;"
msgstr ""

#: ak_vendor/compliances/eucra.py:81
msgid ""
"be designed, developed and produced to reduce the impact of an incident "
"using appropriate exploitation mitigation mechanisms and techniques;"
msgstr ""

#: ak_vendor/compliances/eucra.py:89
msgid ""
"in relation to the risks posed to products with digital elements, address "
"and remediate vulnerabilities without delay, including by providing security "
"updates; where technically feasible, new security updates shall be provided "
"separately from functionality updates;"
msgstr ""

#: ak_vendor/compliances/gdpr.py:8
msgid "Data protection by design and by default"
msgstr ""
Expand Down Expand Up @@ -5090,19 +5161,19 @@ msgid ""
"security controls should periodically be measured and evaluated."
msgstr ""

#: ak_vendor/report/report.py:1083
#: ak_vendor/report/report.py:1104
msgid "Static"
msgstr "静的"

#: ak_vendor/report/report.py:1084
#: ak_vendor/report/report.py:1105
msgid "Dynamic"
msgstr "動的"

#: ak_vendor/report/report.py:1085
#: ak_vendor/report/report.py:1106
msgid "API"
msgstr ""

#: ak_vendor/report/report.py:1086
#: ak_vendor/report/report.py:1107
msgid "Manual"
msgstr "手動"

Expand Down Expand Up @@ -5524,10 +5595,14 @@ msgstr "HIPAA"
msgid "GDPR"
msgstr ""

#: ak_vendor/templates/report_template.html:1466
#: ak_vendor/templates/report_template.html:1690
msgid "DORA"
msgstr ""

#: ak_vendor/templates/report_template.html:1708
msgid "EU CRA"
msgstr ""

#: ak_vendor/templates/report_template.html:1484
msgid "NIST SP 800-53"
msgstr ""
Expand Down
2 changes: 2 additions & 0 deletions ak_vendor/report/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
ASVS,
CWE,
DORA,
EUCRA,
GDPR,
HIPAA,
MASVS,
Expand Down Expand Up @@ -53,6 +54,7 @@
HIPAA.__name__,
DORA.__name__,
GDPR.__name__,
EUCRA.__name__,
NISTSP80053.__name__,
NISTSP800171.__name__,
SAMA.__name__,
Expand Down
21 changes: 21 additions & 0 deletions ak_vendor/report/report.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -631,6 +631,12 @@ class DORA:
title = attr.ib(type=str)


@attr.s
class EUCRA:
code = attr.ib(type=str)
title = attr.ib(type=str)


@attr.s
class NISTSP80053:
code = attr.ib(type=str)
Expand Down Expand Up @@ -664,6 +670,7 @@ class Regulatory:
hipaa = attr.ib(factory=list, type=List[dict])
gdpr = attr.ib(factory=list, type=List[dict])
dora = attr.ib(factory=list, type=List[dict])
eucra = attr.ib(factory=list, type=List[dict])
nistsp80053 = attr.ib(factory=list, type=List[dict])
nistsp800171 = attr.ib(factory=list, type=List[dict])
sama = attr.ib(factory=list, type=List[dict])
Expand All @@ -689,6 +696,7 @@ def from_json(cls, data):
hipaa=[HIPAA.from_json(hipaa) for hipaa in data.get("hipaa", [])],
gdpr=[GDPR(**gdpr) for gdpr in data.get("gdpr", [])],
dora=[DORA(**dora) for dora in data.get("dora", [])],
eucra=[EUCRA(**eucra) for eucra in data.get("eucra", [])],
nistsp80053=[
NISTSP80053(**nistsp80053)
for nistsp80053 in data.get("nistsp80053", [])
Expand Down Expand Up @@ -763,6 +771,10 @@ def create_gdpr(cls, code: str, title: str) -> GDPR:
def create_dora(cls, code: str, title: str) -> DORA:
return DORA(code=code, title=title)

@classmethod
def create_eucra(cls, code: str, title: str) -> EUCRA:
return EUCRA(code=code, title=title)

@classmethod
def create_nistsp80053(cls, code: str, title: str) -> NISTSP80053:
return NISTSP80053(code=code, title=title)
Expand Down Expand Up @@ -825,6 +837,10 @@ def add_dora(self, dora: DORA) -> List[DORA]:
self.dora.append(dora)
return self.dora

def add_eucra(self, eucra: EUCRA) -> List[EUCRA]:
self.eucra.append(eucra)
return self.eucra

def add_nistsp80053(self, nistsp80053: NISTSP80053) -> List[NISTSP80053]:
self.nistsp80053.append(nistsp80053)
return self.nistsp80053
Expand Down Expand Up @@ -875,6 +891,7 @@ class Analysis:
cwe=[],
gdpr=[],
dora=[],
eucra=[],
mstg=[],
masvs=[],
owaspapi2023=[],
Expand Down Expand Up @@ -940,6 +957,7 @@ def create_regulatory(
hipaa: List[dict] = None,
gdpr: List[dict] = None,
dora: List[dict] = None,
eucra: List[dict] = None,
owaspapi2023: List[dict] = None,
owaspmobile2024: List[dict] = None,
nistsp80053: List[dict] = None,
Expand All @@ -960,6 +978,8 @@ def create_regulatory(
gdpr = []
if dora is None:
dora = []
if eucra is None:
eucra = []
if hipaa is None:
hipaa = []
if pcidss is None:
Expand Down Expand Up @@ -989,6 +1009,7 @@ def create_regulatory(
hipaa=hipaa,
gdpr=gdpr,
dora=dora,
eucra=eucra,
nistsp80053=nistsp80053,
nistsp800171=nistsp800171,
sama=sama,
Expand Down
30 changes: 30 additions & 0 deletions ak_vendor/report_sample1.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -159,6 +159,16 @@
"code": "Art. 25(1)",
"title": "Evidenced via vulnerability assessments/scans and penetration testing."
}
],
"eucra": [
{
"code": "Annex I, Part I, point (2)(e)",
"title": "protect the confidentiality of stored, transmitted or otherwise processed data, personal or other, such as by encrypting relevant data at rest or in transit by state of the art mechanisms, and by using other technical means;"
},
{
"code": "Annex I, Part I, point (2)(f)",
"title": "protect the integrity of stored, transmitted or otherwise processed data, personal or other, commands, programs and configuration against any manipulation or modification not authorised by the user, and report on corruptions;"
}
]
},
"risk": {
Expand Down Expand Up @@ -379,6 +389,16 @@
"code": "Art. 25(1)",
"title": "Evidenced via vulnerability assessments/scans, source-code reviews where feasible, and penetration testing."
}
],
"eucra": [
{
"code": "Annex I, Part I, point (2)(d)",
"title": "ensure protection from unauthorised access by appropriate control mechanisms, including but not limited to authentication, identity or access management systems, and report on possible unauthorised access;"
},
{
"code": "Annex I, Part I, point (2)(j)",
"title": "be designed, developed and produced to limit attack surfaces, including external interfaces;"
}
]
},
"risk": {
Expand Down Expand Up @@ -827,6 +847,16 @@
"code": "Art. 25(1)",
"title": "Evidenced via vulnerability assessments/security testing."
}
],
"eucra": [
{
"code": "Annex I, Part I, point (2)(e)",
"title": "protect the confidentiality of stored, transmitted or otherwise processed data, personal or other, such as by encrypting relevant data at rest or in transit by state of the art mechanisms, and by using other technical means;"
},
{
"code": "Annex I, Part II, point (2)",
"title": "in relation to the risks posed to products with digital elements, address and remediate vulnerabilities without delay, including by providing security updates; where technically feasible, new security updates shall be provided separately from functionality updates;"
}
]
},
"risk": {
Expand Down
Loading
Loading