PaperlayerView exact revision on arXiv

Source-linked AI summary

CYBERFORT: A Compliance-Chain Platform Operationalising the Cyber Resilience Act for SMEs

Nikolaos Kekatos, Georgios Koutidis, Mihaela Curcă, Angelos Fountoulakis, Marios Ioannou, Michael Ioannou, Elias Iosif, Paul Lacatus, Alexios Lekidis, Avgi Michael, Tom Nianios

arXiv:2610.09918v1cs.CRcs.CYcs.SE

TL;DR

The CRA creates lifecycle cybersecurity obligations for digital products, a challenge for SMEs with low awareness and fragmented security practices. CYBERFORT operationalizes those obligations through a traceable compliance chain, and its completed case study demonstrates traceability across CRA objectives; independent usability and effectiveness evidence remains unavailable.

  • Problem

    SMEs make up most manufacturers, distributors, importers, and suppliers of digital products, but only 12.3% of surveyed SMEs were aware of the CRA in 2024, and their security governance is often fragmented.

    Source: §I · p. 1

  • Method

    CYBERFORT operationalizes CRA requirements through a compliance chain linking product risks, controls, policies, obligations, and evidence, with scanner findings made into evidence objects.

    Source: §I · p. 1, C. Implementation and Engineering · p. 3, E. Scanner Integration and Evidence… · p. 4

  • Results

    In the SIEM/XDR case study, 27 of 42 CRA objectives mapped to at least one control, while the remaining 15 surfaced as gaps.

    Source: B. Measured Results: NextGen SIEM Pro · p. 5

  • Takeaways & Limitations

    The case study demonstrates full intra-chain traceability across 27 of 42 CRA objectives for a SIEM/XDR product spanning conventional and AI/autonomous-operation risks.

    Source: §VI · p. 6

    The completed case study was conducted by CYBERFORT’s developer, making it an existence proof rather than independent usability or effectiveness evidence; baseline-dependent metrics await the ongoing controlled study.

    Source: C. Threats to Validity and Planned… · pp. 5–6

Abstract

from arXiv · show

The EU Cyber Resilience Act (CRA) turns product cybersecurity into a lifecycle compliance obligation for manufacturers, importers, distributors, and integrators of products with digital elements on the EU market, a load that falls largely on small and medium-sized enterprises (SMEs) that rarely have dedicated governance, risk, and compliance (GRC) capacity. We present CYBERFORT, an open-source CRA-first compliance platform developed under the EU Digital Europe Programme and one of twelve projects in the EU CRA cluster. CYBERFORT operationalises the CRA through a guided scope self-assessment, a question bank tied to Annex I and the vulnerability-handling obligations, and a compliance-checking engine that links every answer to controls, policies, and machine-attested evidence, reusing ISO/IEC 27001, NIS2, and GDPR controls only where they coincide with CRA obligations. Its central contribution is the compliance chain, a traceable structure linking each product risk through its controls and policies to the CRA obligations it satisfies, and onward through evidence to the technical-documentation file and EU declaration of conformity, so that every operational gap is traceable and can be closed before market placement. Deployed at https://access.cyber-fort.eu/ for a first cohort of 43 organisations, the platform is presented with the engineering behind the chain, measured results from a completed end-to-end case study on a SIEM/XDR product with AI-driven remediation spanning the CRA obligation chapters, and the controlled effort study that remains in progress.

I. INTRODUCTION

The CRA imposes lifecycle cybersecurity obligations on product operators, while SMEs—who make up most such operators—report low awareness and rely on fragmented security tools. CYBERFORT organizes CRA work as a traceable compliance chain and provides CRA-oriented modules and scanning for SMEs.

I. INTRODUCTION

  • SMEs make up the bulk of European manufacturers, distributors, importers, and suppliers of digital products, yet only 12.3% of surveyed SMEs knew of the CRA in 2024.The corresponding awareness rate among very large enterprises was 83.5%; SME security governance commonly relies on fragmented spreadsheets, tickets, policies, and scanners.Source: §I · p. 1

A. Contributions •

  • The compliance chain connects products, risks, controls, policies, CRA obligations, evidence, corrective actions, and conformity documents as linked nodes.It makes operational gaps traceable so they can be assigned, monitored, and closed before market placement.Source: A. Contributions • · p. 1, §I · p. 1
  • CYBERFORT combines four CRA-oriented modules with multi-framework control reuse and scanners that turn technical findings into evidence attributable to Annex I obligations.Its AI-control family addresses autonomous-operation risks.Source: A. Contributions • · pp. 1–2
  • The open-source platform serves 43 organisations and includes measured results from a completed SIEM/XDR case study with AI-driven remediation.The paper also describes the engineering behind the compliance chain.Source: A. Contributions • · p. 2

II. BACKGROUND AND RELATED WORK

The CRA combines lifecycle duties with risk-based calibration and conformity requirements, while SME preparedness and existing tools leave room for end-to-end, traceable workflows. CYBERFORT is positioned as an integration layer among CRA-cluster projects and existing compliance tools.

II. BACKGROUND AND RELATED WORK

  • The CRA requires lifecycle risk assessment, vulnerability handling, technical documentation, and an EU declaration of conformity; reporting applies from September 2026 and Annex I requirements from December 2027,.Legal analysis describes the regime as combining command-and-control duties, risk-based calibration, harmonised standards, and enforced self-regulation.Source: §II · p. 2
  • Prior SME work maps commonly implemented controls to CRA, ISO/IEC 27001, and CIS, but existing initiatives rarely provide an end-to-end traceable CRA workflow.The passage also characterizes CRA awareness among SMEs as low.Source: §II · p. 2
  • CYBERFORT complements CRA-cluster standards and SME-capacity projects by emphasizing an end-to-end integration layer rather than a standards- or tool-focused deliverable,.The cluster spans standards coordination and tools for SBOM, conformity assessment, compliance automation, AI, certification, and SME compliance.Source: §II · p. 2
  • Existing GRC suites, attestation tools, scanners, and read-only crosswalks each cover only parts of the CRA lifecycle, while CYBERFORT links artefacts to Annex I obligations and declaration line items,.Its chain integrates standards mapping, SBOM, risk, controls, evidence, and conformity.Source: §II · p. 2

III. CYBERFORT PLATFORM OVERVIEW

CYBERFORT is a web-based GRC platform with a role-based interface, framework data, and integrations to containerised assessment tools. Its data model and navigation organize CRA-relevant entities and capabilities.

III. CYBERFORT PLATFORM OVERVIEW

  • CYBERFORT uses a FastAPI backend, React front end, and PostgreSQL database, with role-based access control and integrations to containerised security-assessment tools.The platform also includes framework seed data.Source: §III · p. 2
  • The data model represents organisations, users, frameworks, objectives, assets, products, risks, controls, policies, assessments, and documents as first-class entities..Source: §III · p. 2
  • The live deployment groups CRA capabilities in navigation from assessments and products through evidence documents, technical files, compliance chains, security tools, and audit engagements.Headline counters report the current first-cohort load.Source: §III · p. 2

A. High-Level Architecture

The architecture places CRA-centered framework data and services between SME inputs and compliance outputs, with assessment tools integrated as evidence producers. Outputs trace back to the relevant product and compliance artefacts.

A. High-Level Architecture

  • Figure 2 organizes the architecture into five layers: input, framework, service, integration, and output.Inputs include SME profiles, products, assets, and scan results; CRA is primary, with ISO/IEC 27001, NIS2, and GDPR as reusable control sources.Source: A. High-Level Architecture · p. 2
  • The service layer contains sixteen modules arranged in four rows, and the integration layer exposes security tools as Evidence producers.The listed tools are OWASP ZAP, Semgrep, Syft, OSV Scanner, and Nmap.Source: A. High-Level Architecture · p. 2
  • The output layer includes technical documents, risk and gap reports, an audit pack, and an EU declaration draft, each tracing back to product and compliance objects.The described trace includes requirements, risks, controls, policies, and evidence.Source: A. High-Level Architecture · p. 3

B. The Compliance Chain

The compliance chain replaces disconnected artefacts with a traceable product-to-conformity path linking risks, controls, policies, CRA objectives, evidence, gaps, and corrective actions. Its relational implementation supports typed traversal, while systematic load benchmarking remains planned.

B. The Compliance Chain

  • The chain connects products and risks to controls, policies, CRA obligations, assessment evidence, gaps, corrective actions, technical documentation, and the EU declaration.Unlike traditional GRC tools that store artefacts separately, it creates a traceable path from product to conformity artefacts.Source: B. The Compliance Chain · p. 3
  • In the NextGen SIEM Pro example, an SBOM dependency vulnerability remains traceable from a partially covered requirement to an upgrade-pending corrective action and declaration line item.The path includes an OSV-Scanner report, a vulnerability-management policy, and the technical-file vulnerability-handling record.Source: B. The Compliance Chain · p. 3
  • A single penetration-test report can support CRA, ISO/IEC 27001, and NIS2 obligations, avoiding duplicate evidence uploads.The chain also lets SMEs trace which risk justifies a control, what evidence proves implementation, and which gap blocks readiness.Source: B. The Compliance Chain · p. 3

C. Implementation and Engineering

  • PostgreSQL stores chain nodes as first-class tables and edges as typed association rows, queried through recursive joins along the product-to-declaration path.The relational design is chosen for bounded, well-typed traversal and roll-up, and lets SMEs self-host without a separate graph database.Source: C. Implementation and Engineering · p. 3
  • The hosted instance serves 43 organisations on a single node, while systematic load benchmarking remains planned.Containerised deployment also supports self-hosting on one virtual machine; stateless API workers can scale horizontally.Source: C. Implementation and Engineering · p. 3

IV. PROPOSED CRA MODULES

CYBERFORT maps CRA provisions to controls from other frameworks and links product risks to treatment actions. Its architecture presents the platform modules alongside the Wrappers bus for assessment tools.

A. Compliance Mapping and Gap Analysis

  • Mappings connect CRA provisions to other-framework controls, classify coverage, and expose missing controls, evidence, outdated policies, open actions, and unassessed products.Coverage can be full, partial, absent, not applicable, or in need of review.Source: A. Compliance Mapping and Gap Analysis · p. 3

B. Risk Assessment

  • The risk module links product assets, threats, vulnerabilities, impacts, likelihood, severity, residual risk, and treatment actions.Product records also capture intended purpose, foreseeable use, operating environment, support period, components, and third-party dependencies.Source: B. Risk Assessment · p. 3
  • The architecture depicts sixteen modules in four rows—governance, compliance-chain data, operations, and automation—connected through a Wrappers bus.The regulatory layer distinguishes the primary CRA framework from reusable ISO/IEC 27001, NIS2, and GDPR frameworks.Source: Figure 2 · p. 4

C. Control and Policy Management

CYBERFORT links controls and policies to product risks and CRA requirements, prepares conformity documentation, and turns scanner findings into evidence linked to CRA objectives.

C. Control and Policy Management

  • Controls link to risks and requirements, while policies document implementation and evidence demonstrates it; the module tracks ownership, approvals, versions, reviews, applicability, and exceptions.Representative policies cover product cybersecurity, secure development, vulnerability and patch management, support, risk methods, monitoring, and market-surveillance communication.Source: C. Control and Policy Management · p. 4

D. EU Conformity Support

  • The conformity module gathers product and operator details, applicable requirements, risk and test evidence, procedures, instructions, and declaration content into a readiness package.It supports structured preparation and traceability but does not replace notified-body or legal review.Source: D. EU Conformity Support · p. 4

E. Scanner Integration and Evidence Automation

  • Containerised scanners produce evidence objects linked to products, assessments, and CRA objectives, with provenance retained for audit and freshness checks.The onboarded product had 463 findings: 13 high, 286 medium, and 164 informational; 52 findings (11%) were linked to product risks.Source: E. Scanner Integration and Evidence… · p. 4

F. End-to-End Workflow

The workflow moves from CRA framework import and product registration through risk and conformity assessment to gap closure and readiness-package export. Four pilot profiles are in scope, but only the NextGen SIEM Pro case has been executed end-to-end on the live platform.

F. End-to-End Workflow

  • The six-step workflow imports the CRA template, registers products and operator details, assesses risk and conformity, links answers to evidence and policies, assigns corrective actions, and exports a readiness package.Risk assessment is embedded across the product lifecycle.Source: F. End-to-End Workflow · pp. 4–5
  • The aggregate scan findings view normalises multi-scanner evidence into one register, rolled up by severity and risk linkage, and makes it available as Evidence objects for Annex I Part II.Source: Figure 3 · p. 5

V. EVALUATION

  • Four SME pilot profiles cover managed-security-services manufacturing, fintech, maritime operations, and energy-sector vulnerability assessment, but only NextGen SIEM Pro is complete end-to-end.The other three pilots are provisioned and in progress.Source: §V · p. 5

A. Metrics

CYBERFORT evaluates CRA coverage, assessment effort, evidence reuse, conformity-document readiness, and user acceptance; the completed SIEM Pro case mapped 27 of 42 objectives and surfaced 15 gaps.

A. Metrics

  • The evaluation metrics cover requirement coverage and gap detection, time-to-assessment, evidence completeness and reuse, conformity-document readiness, and user acceptance.Evidence reuse is assessed across CRA, ISO/IEC 27001, NIS2, GDPR, and NIST CSF 2.0.Source: A. Metrics · p. 5

B. Measured Results: NextGen SIEM Pro

  • 27 of 42 CRA objectives were mapped to controls, leaving 15 explicit, assignable gaps in the NextGen SIEM Pro case.The same instance sustained the first cohort of 43 organisations.Source: B. Measured Results: NextGen SIEM Pro · p. 5, Table I · p. 5
  • Scanner findings from Syft, OSV-Scanner, Semgrep, OWASP ZAP, and Nmap became provenance-carrying Evidence objects mapped to Annex I Part II obligations.Each assessment answer linked to a control, policy, and CRA objective; covered objectives linked back to product risks.Source: B. Measured Results: NextGen SIEM Pro · p. 5

C. Threats to Validity and Planned Controlled Study

The completed case demonstrates chain expressiveness and traceability, but its developer-run setting does not independently establish usability or effectiveness; a controlled effort study remains underway.

C. Threats to Validity and Planned Controlled Study

  • The Clone Systems-run case is an existence proof for end-to-end traceability, not independent evidence of usability or effectiveness.Its supported claims are restricted to chain expressiveness for a realistic conventional and AI/autonomous-risk scenario and traceability across the covered scope.Source: C. Threats to Validity and Planned… · pp. 5–6
  • Dealio, Columbia, and Eximprod Engineering are provisioned as independent pilots to provide external evidence beyond the completed case.The planned expert review involves two to four practitioners assessing usability and trustworthiness.Source: C. Threats to Validity and Planned… · p. 6
  • Time-to-assessment, cross-framework evidence-reuse magnitude, and user-acceptance ratings are unreported because the controlled study is still running.The study pairs pilot SMEs against a spreadsheet-and-free-form baseline and includes expert review of the compliance chain and conformity materials.Source: C. Threats to Validity and Planned… · p. 6

D. Coverage of CRA Obligations

CYBERFORT reports traceability across 27 of 42 CRA objectives in a SIEM/XDR case, while its obligation-coverage account distinguishes supported obligations from partial or out-of-scope ones.

D. Coverage of CRA Obligations

  • The completed SIEM/XDR case demonstrated full intra-chain traceability across 27 of 42 CRA objectives, spanning conventional and AI/autonomous-operation risks.Table II summarizes which obligation families are supported, partial, or out of scope and the artifacts produced for each.Source: §VI · p. 6, D. Coverage of CRA Obligations · p. 6

VI. DISCUSSION, CONCLUSION, AND FUTURE WORK

  • The discussion identifies evidence-aware cross-mapping, broader evidence automation, role-specific conformity workflows, and an ENISA single-reporting integration as remaining directions.It also calls for the controlled effort study and expert review across three independent pilots.Source: §VI · p. 6
Loading 2610.09918v1…