Skip to main content

Cybersecurity Risk Assessment Documentation for Software

The cybersecurity risk assessment is the cornerstone of your entire compliance effort under the Cyber Resilience Act (CRA). It is not an optional extra; a copy of this assessment is a mandatory component of your Technical Documentation.

Central Requirement in Annex VII​

Annex VII, point 3, explicitly requires the technical documentation to contain "an assessment of the cybersecurity risks against which the product with digital elements is designed, developed, produced, delivered and maintained pursuant to Article 13".

What Your Documented Risk Assessment Must Show​

This document is where you connect the dots for the authorities. It should demonstrate:

  • Risk Identification: What cybersecurity risks did you identify for your app, game, or software, considering both its intended purpose and reasonably foreseeable use?
  • Applicability of Essential Requirements: How did this risk assessment inform which of the essential cybersecurity requirements from Annex I, Part I, were applicable to your product?
  • Justification: If you deemed any essential requirements "not applicable," this is where your clear justification must live (Article 13, Paragraph 4).
  • Implementation Strategy: A description of the solutions you adopted to meet the applicable requirements.

This document tells the story of your security journey: what you were worried about, what rules you determined you had to follow as a result, and how you followed them.

A Living Document​

Remember, your risk assessment needs to be updated as appropriate during your software's support period (Article 13, Paragraph 3). The version in your Technical Documentation should reflect the current state of your product's risk profile.

Key Takeway​

Your complete cybersecurity risk assessment document is a required element of your Technical Documentation. It must explain the identified risks and detail how the essential cybersecurity requirements from Annex I apply to your software as a result.