The product-security glossary.
Twenty terms you'll meet in CRA work. Start with the definition, then follow the evidence into your product.
Actively exploited vulnerability ↗
An actively exploited vulnerability is a weakness for which exploitation evidence is relevant to the CRA Article 14 reporting trigger. In CRA work, the term should be understood in the context of the product, its supported release and the relevant legal duty.
CE marking ↗
CE marking indicates a manufacturer’s declaration that the product meets the applicable EU requirements. In CRA work, the term should be understood in the context of the product, its supported release and the relevant legal duty.
Coordinated vulnerability disclosure ↗
Coordinated vulnerability disclosure is a process for receiving, assessing and addressing security reports with the reporter. In CRA work, the term should be understood in the context of the product, its supported release and the relevant legal duty.
Coordinator CSIRT ↗
A coordinator CSIRT is the designated computer security incident response team involved in CRA reporting. In CRA work, the term should be understood in the context of the product, its supported release and the relevant legal duty.
CSAF ↗
Common Security Advisory Framework is a machine-readable format for security advisories. In CRA work, the term should be understood in the context of the product, its supported release and the relevant legal duty.
Cybersecurity risk assessment ↗
A cybersecurity risk assessment identifies product risks and explains how the design and controls address them. In CRA work, the term should be understood in the context of the product, its supported release and the relevant legal duty.
CycloneDX ↗
CycloneDX is a standard format for describing software and other supply-chain inventory information. In CRA work, the term should be understood in the context of the product, its supported release and the relevant legal duty.
Declaration of conformity ↗
The EU declaration of conformity is the manufacturer’s formal statement against the applicable EU legislation. In CRA work, the term should be understood in the context of the product, its supported release and the relevant legal duty.
EUVD ↗
The European Vulnerability Database is ENISA’s vulnerability information service. In CRA work, the term should be understood in the context of the product, its supported release and the relevant legal duty.
KEV ↗
The CISA Known Exploited Vulnerabilities catalog lists vulnerabilities known to have been exploited. In CRA work, the term should be understood in the context of the product, its supported release and the relevant legal duty.
Notified body ↗
A notified body is an organisation designated to carry out specified conformity-assessment tasks under EU legislation. In CRA work, the term should be understood in the context of the product, its supported release and the relevant legal duty.
Product with digital elements ↗
A product with digital elements is the CRA product concept covering relevant hardware and software with a data connection. In CRA work, the term should be understood in the context of the product, its supported release and the relevant legal duty.
SBOM ↗
A software bill of materials is a machine-readable inventory of software components and their relationships. In CRA work, the term should be understood in the context of the product, its supported release and the relevant legal duty.
Secure by default ↗
Secure by default means the product’s initial configuration is designed to reduce relevant security risks without relying on users to discover basic protections. In CRA work, the term should be understood in the context of the product, its supported release and the relevant legal duty.
security.txt ↗
security.txt is a standardised file that helps researchers discover security contacts and disclosure information. In CRA work, the term should be understood in the context of the product, its supported release and the relevant legal duty.
Single Reporting Platform ↗
The Single Reporting Platform is ENISA’s electronic route for CRA notifications. In CRA work, the term should be understood in the context of the product, its supported release and the relevant legal duty.
SPDX ↗
SPDX is a standard for exchanging software bill of materials and related software information. In CRA work, the term should be understood in the context of the product, its supported release and the relevant legal duty.
Support period ↗
The support period is the period during which the manufacturer maintains the required vulnerability-handling and security-update commitment. In CRA work, the term should be understood in the context of the product, its supported release and the relevant legal duty.
Technical file ↗
The CRA technical file is the evidence set described in Annex VII for the product and its conformity. In CRA work, the term should be understood in the context of the product, its supported release and the relevant legal duty.
VEX ↗
Vulnerability Exploitability eXchange records whether a vulnerability affects a particular product and why. In CRA work, the term should be understood in the context of the product, its supported release and the relevant legal duty.