Three micro-tools for CRA readiness

1. security.txt generator (RFC 9116)

A security.txt file, placed at /.well-known/security.txt, tells security researchers how to reach you with a vulnerability. It is the practical front door for the coordinated vulnerability disclosure the CRA expects.

“vulnerabilities of a product with digital elements are handled effectively and in accordance with the essential cybersecurity requirements”

“A manufacturer shall notify any actively exploited vulnerability contained in the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator, in accordance with paragraph 7 of this Article, and to ENISA.”

2. Support-period calculator (Art. 13(8))

Manufacturers must declare a support period. The law sets a floor, but a shorter expected in-use time can lower it. Enter how long the product is expected to stay in use.

“the support period shall be at least five years”

“Where the product with digital elements is expected to be in use for less than five years, the support period shall correspond to the expected use time.”

3. Vulnerability disclosure policy (VDP) template

A short, publishable policy that tells researchers you will not sue them for good-faith reporting and states your commitments. It pairs with the security.txt above.

“vulnerabilities of a product with digital elements are handled effectively and in accordance with the essential cybersecurity requirements”

“without undue delay and in any event within 24 hours of the manufacturer becoming aware of it”

“within 72 hours”