CRA Compliance Working Matrix
Status: DRAFT
This is a working engineering matrix, not a legal declaration of conformity.
| Control area | Applicable | Current implementation | Evidence | Status |
|---|---|---|---|---|
| Secure-by-default configuration | Yes | custom appliance image | TODO | PARTIAL |
| Unique device identity | Yes | NATS JWT + backend device record | TODO | VERIFY |
| Authentication | Yes | NATS JWT, VPN | TODO | PARTIAL |
| Authorization / least privilege | Yes | NATS permissions | negative authorization tests | VERIFY |
| Confidentiality in transit | Yes | VPN + secure NATS transport | config captures | VERIFY |
| Integrity in transit | Yes | VPN + secure NATS transport | config captures | VERIFY |
| Attack surface minimization | Yes | outbound architecture | network scan | VERIFY |
| Protection against unauthorized control | Yes | local supervisor / command model | tests | VERIFY |
| Secure updates | Yes | TODO | update tests | TODO |
| Vulnerability handling | Yes | TODO | policy + register | TODO |
| SBOM | Yes | TODO | CycloneDX file | TODO |
| Security logging/audit | Yes | TODO | audit-log tests | TODO |
| Availability / resilience | Yes | local supervisor | offline tests | PARTIAL |
| Credential revocation | Yes | NATS/VPN capabilities expected | revocation test | VERIFY |
| Security support period | Yes | TODO | support-lifecycle.md | TODO |