Current Security / Compliance Status
This file is the quick engineering view of the current EMS Gateway state based on the information available today.
| Area | Current state | Assessment |
|---|---|---|
| VPN | Implemented | Good foundation; verify unique per-device keys and network scope |
| NATS JWT authentication | Implemented | Good foundation; verify unique cryptographic identity per device |
| NATS authorization | Implemented/expected | Need negative cross-device ACL tests |
| Backend registration | e-mail + Raspberry Pi serial | Useful inventory/ownership binding, but not sufficient authentication by itself |
| Device cryptographic identity | NATS/VPN likely provide this | VERIFY exact provisioning/key model |
| Credential revocation | Unknown | VERIFY |
| Credential rotation | Unknown | TODO/VERIFY |
| Raw Modbus isolation | Supervisor architecture | VERIFY that no remote raw-write path exists |
| Command audit trail | Unknown | TODO/VERIFY |
| Signed OTA | Unknown/not complete | TODO |
| SBOM | Not yet automated | TODO |
| Vulnerability management | Not formalized | TODO |
| Production default password | Must be verified | Shared default password is not acceptable |
| Read-only/minimized filesystem | Not complete | Recommended hardening |
| Secure element | Not present | Optional but useful hardening |
| Offline fail-safe | Partially implemented by local supervisor | Document and test |
| RED/CE final-product evidence | Not assembled | TODO before market release |
Key conclusion
VPN + NATS JWT + backend registration by e-mail and Raspberry Pi serial are a strong start for authentication, authorization and fleet ownership, but they are not sufficient on their own to claim full CRA / RED / ETSI EN 303 645 compliance.
The largest remaining engineering/compliance items are signed updates, credential lifecycle, auditability, SBOM/vulnerability handling, hardening, offline/fail-safe evidence and final-product RED/CE documentation.