EMS Gateway Compliance Dossier

Status: DRAFT / WORKING DOCUMENTATION

This repository contains the cybersecurity and product-compliance evidence for the EMS Gateway. It is intended to be maintained together with the product source code and release process.

Current product baseline

• Raspberry Pi Zero W based gateway
• RS485 HAT used to communicate with supported inverters
• outbound connectivity to the backend
• VPN connectivity
• NATS with JWT-based device authentication/authorization
• device registration in the backend linked to customer e-mail and Raspberry Pi serial number
• local supervisor controlling the inverter through semantic operations over Modbus/RS485

Important distinction

Backend registration by e-mail + Raspberry Pi serial number is device inventory / ownership binding, not a cryptographic device identity on its own. The security identity should be based on unique device credentials (for example NATS NKey/JWT and VPN keys/certificates), while the serial number is used as an inventory attribute.

Evidence model

Every security requirement should have four things:

1. Requirement
2. Implementation
3. Verification/test
4. Evidence

A control is not considered complete only because it is described in documentation.

Status vocabulary

• PASS - implemented and evidence exists
• PARTIAL - implemented partially or evidence is incomplete
• TODO - not implemented yet
• N/A - not applicable with rationale
• VERIFY - implementation probably exists but must be verified

First milestone

Complete these documents first:

• 00-product/product-description.md
• 01-architecture/system-architecture.md
• 01-architecture/trust-boundaries.md
• 02-risk-assessment/threat-model.md
• 02-risk-assessment/risk-register.csv
• 03-requirements/cra-matrix.md
• 03-requirements/etsi-en-303-645-matrix.md
• 04-security/device-identity.md
• 04-security/secure-update.md
• 05-vulnerability-management/vulnerability-management.md
• 06-sbom/README.md

Release evidence

Create one evidence directory per released firmware/image version:

evidence/
└── 0.1.0/
    ├── manifest.json
    ├── sbom.cdx.json
    ├── vulnerabilities.json
    ├── packages.txt
    ├── sha256sums.txt
    ├── network-surface.txt
    └── test-report.md

Do not put secrets, NATS seeds, VPN private keys or customer data in this repository.