Translations:Cyber Resilience Act (CRA)/36/en

Art 23 requires maintaining comprehensive technical documentation. This documentation must include not only a general description of the product and its intended use but also detailed information on product design, development, and manufacturing aspects. Additionally, a thorough assessment of cybersecurity risks throughout the product’s entire lifecycle is required. Another key part of the documentation is the description of procedures for vulnerability handling. This includes information on the product’s design and development, which may be supplemented by diagrams, schematics, or a description of the system architecture. Furthermore, a concept for coordinated vulnerability disclosure, as well as specifications for manufacturing and monitoring processes including validation, must be documented.