Platanor/hardware-compliance-handbook

Full legal text of the license: https://creativecommons.org/licenses/by/4.0/legalcode

https://creativecommons.org/licenses/by/4.0/legalcode

Human-readable summary: https://creativecommons.org/licenses/by/4.0/

https://creativecommons.org/licenses/by/4.0/

[![License: CC BY 4.0](https://img.shields.io/badge/License-CC%20BY%204.0-lightgrey.svg)](https://creativecommons.org/licenses/by/4.0/) [![Regulations covered](https://img.shields.io/badge/regulations-CRA%20%7C%20RED%20%7C%20NIS2%20%7C%20CS

Prepared by **Platanor Technologies** ([platanor.com](https://platanor.com)) — an embedded security firm for IoT device manufacturers.

**Contents:** [Quick start](#quick-start) · [What this is](#what-this-is) · [Repository structure](#repository-structure) · [Methodology](#methodology-and-sourcing) · [Using with an LLM](#how-to-use-this-with-an-llm) · [Claude Skill](#insta

This repository has a [`SKILL.md`](SKILL.md) file at its root, alongside the reference files — so it can be installed as a [Claude Skill](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/overview): a packaged capability tha

git clone https://github.com/Platanor/hardware-compliance-handbook.git ~/.claude/skills/hardware-compliance-handbook

**Claude API / your own application:** upload the repository as a Custom Skill through the Skills API (`/v1/skills`). See Anthropic's [Agent Skills documentation](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/overview) f

Found an error, an outdated date, or an inaccurate interpretation? Let us know — contact details at [platanor.com](https://platanor.com), or open an issue or pull request directly. See [`CONTRIBUTING.md`](CONTRIBUTING.md) for what belongs h

Have a question, a use case to share, or want to suggest what should be covered next? Use [GitHub Discussions](https://github.com/Platanor/hardware-compliance-handbook/discussions) — issues/PRs are for content fixes, Discussions is for ever

This means you're free to copy, redistribute, adapt, and even use these materials commercially — provided you give attribution: credit **Platanor Technologies** ([platanor.com](https://platanor.com)) as the source and link to the license.

Full license text: [creativecommons.org/licenses/by/4.0](https://creativecommons.org/licenses/by/4.0/). Details in the [`LICENSE`](./LICENSE) file.

Official references: - CRA: Regulation (EU) 2024/2847, `https://eur-lex.europa.eu/eli/reg/2024/2847/oj`

- CRA: Regulation (EU) 2024/2847, `https://eur-lex.europa.eu/eli/reg/2024/2847/oj`

- RED: Directive 2014/53/EU, `https://eur-lex.europa.eu/eli/dir/2014/53/oj`

- NIS2: Directive (EU) 2022/2555, `https://eur-lex.europa.eu/eli/dir/2022/2555/oj`

- CSA: Regulation (EU) 2019/881, `https://eur-lex.europa.eu/eli/reg/2019/881/oj`

The technical solution uses SBOM-generation tools ([Syft](https://github.com/anchore/syft), CycloneDX CLI, cdxgen), exporting to the standard machine-readable CycloneDX or SPDX formats in JSON or XML — Syft builds an SBOM by inspecting cont

- A downloadable Excel self-check tool with automatic scoring and progress tracking across repeated runs. - [Online Cybersecurity Maturity Assessment for SMEs tool](https://tools.enisa.europa.eu/cybersecurity-maturity-assessment-for-small-a

- [Online Cybersecurity Maturity Assessment for SMEs tool](https://tools.enisa.europa.eu/cybersecurity-maturity-assessment-for-small-and-medium-enterprises).

- [SME CRA Survey Report](https://www.enisa.europa.eu/publications/sme-cra-survey-report) — baseline data from a survey of 194 organisations across 31 countries (February–March 2026), showing where European SMEs actually stood at the time t

This model works well as a fast first step: in about 2 hours, a company gets a structured picture of its weak spots, framed in terms that line up with what the CRA actually asks for. But since the model deliberately **does not distinguish b

*Source: ENISA, SME Cyber Resilience Maturity Assessment Model, July 2026 (CC-BY 4.0). Official publication page: <https://www.enisa.europa.eu/publications/sme-cyber-resilience-maturity-assessment-model>*

> **Primary source. Quote regulation wording from this file, not from summaries or the web.** > > - **Source:** EUR-Lex, CELEX `32024R2847` — <https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847>

> > - **Source:** EUR-Lex, CELEX `32024R2847` — <https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847> > - **Retrieved:** 2026-07-22 · SHA-256 of retrieved HTML: `f15053da31b9e9d8d6c3e34259fd05f1d0f1eefefbbef4981462d187

> - **Source:** EUR-Lex, CELEX `32024R2847` — <https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847>

( 14 ) Commission Delegated Regulation (EU) 2022/30 of 29 October 2021 supplementing Directive 2014/53/EU of the European Parliament and of the Council with regard to the application of the essential requirements referred to in Article 3(3)

( 15 ) Directive 2014/53/EU of the European Parliament and of the Council of 16 April 2014 on the harmonisation of the laws of the Member States relating to the making available on the market of radio equipment and repealing Directive 1999/

( 16 ) Directive (EU) 2024/2853 of the European Parliament and of the Council of 23 October 2024 on liability for defective products and repealing Council Directive 85/374/EEC ( OJ L, 2024/2853, 18.11.2024, ELI: http://data.europa.eu/eli/di

( 17 ) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directiv

( 18 ) Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC ( OJ L 25

( 19 ) Regulation (EU) 2024/1781 of the European Parliament and of the Council of 13 June 2024 establishing a framework for the setting of ecodesign requirements for sustainable products, amending Directive (EU) 2020/1828 and Regulation (EU

( 20 ) Commission Implementing Regulation (EU) 2024/482 of 31 January 2024 laying down rules for the application of Regulation (EU) 2019/881 of the European Parliament and of the Council as regards the adoption of the European Common Criter

( 21 ) Regulation (EU) 2023/988 of the European Parliament and of the Council of 10 May 2023 on general product safety, amending Regulation (EU) No 1025/2012 of the European Parliament and of the Council and Directive (EU) 2020/1828 of the 

( 22 ) Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/

( 31 ) OJ L 123, 12.5.2016, p. 1 . ( 32 ) Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by the Member States of t

OJ L 123, 12.5.2016, p. 1 . ( 32 ) Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by the Member States of the Comm

( 32 ) Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by the Member States of the Commission’s exercise of impleme

The full text of the EU declaration of conformity is available at the following internet address: … ( 1 ) OJ L, 2024/2847, 20.11.2024, ELI: http://data.europa.eu/eli/reg/2024/2847/oj .

( 1 ) OJ L, 2024/2847, 20.11.2024, ELI: http://data.europa.eu/eli/reg/2024/2847/oj . ## ANNEX VII

OJ L, 2024/2847, 20.11.2024, ELI: http://data.europa.eu/eli/reg/2024/2847/oj .

8. Authorised representative The manufacturer’s obligations set out in points 3.1, 3.5, 5 and 6 may be fulfilled by its authorised representative, on its behalf and under its responsibility, provided that the relevant obligations are specif

The manufacturer’s obligations set out in points 3.1, 3.5, 5 and 6 may be fulfilled by its authorised representative, on its behalf and under its responsibility, provided that the relevant obligations are specified in the mandate. A stateme

A statement has been made with regard to this act and can be found in OJ C, 2024/6786, 20.11.2024, ELI: http://data.europa.eu/eli/C/2024/6786/oj .

ELI: http://data.europa.eu/eli/reg/2024/2847/oj

> > - **Document:** Commission Implementing Decision of 3.2.2025 on a standardisation request to CEN, Cenelec and ETSI as regards products with digital elements in support of Regulation (EU) 2024/2847. Commonly cited as **M/606**. Only the 

> - **Document:** Commission Implementing Decision of 3.2.2025 on a standardisation request to CEN, Cenelec and ETSI as regards products with digital elements in support of Regulation (EU) 2024/2847. Commonly cited as **M/606**. Only the En

> - **Official record:** <https://ec.europa.eu/transparency/documents-register/detail?ref=C(2025)618&lang=en> > - **Provenance:** the two official PDFs (`C(2025)618_0.pdf` — decision body, 9 pp., certified copy signed for the Secretary-Gene

> **Source:** EUR-Lex, CELEX [32019R0881](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019R0881) — Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency fo

The legal basis for this is **Commission Decision 2011/833/EU** on the reuse of Commission documents, as reflected in the [EUR-Lex legal notice](https://eur-lex.europa.eu/content/legal-notice/legal-notice.html): legal texts published on EUR

> **Primary source. Quote regulation wording from this file, not from summaries or the web.** > > - **Source:** EUR-Lex, CELEX `32022L2555` — <https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022L2555>

> > - **Source:** EUR-Lex, CELEX `32022L2555` — <https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022L2555> > - **Retrieved:** 2026-08-11, via rendered page extraction (Chrome, JS-rendered — EUR-Lex's HTML view is client-ren

> - **Source:** EUR-Lex, CELEX `32022L2555` — <https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022L2555> > - **Retrieved:** 2026-08-11, via rendered page extraction (Chrome, JS-rendered — EUR-Lex's HTML view is client-rende

> - **Retrieved:** 2026-08-11, via rendered page extraction (Chrome, JS-rendered — EUR-Lex's HTML view is client-rendered and a plain HTTP fetch/curl returns only a cookie-consent shell, not the document text).

> **Primary source. Quote regulation wording from this file, not from summaries or the web.** > > - **Source:** EUR-Lex, CELEX `32022R0030` — <https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0030>

> > - **Source:** EUR-Lex, CELEX `32022R0030` — <https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0030> > - **Retrieved:** 2026-07-22 · SHA-256 of retrieved HTML: `d82424d16fab54a45fb5024d4358b9de3dbe9e3f8addc64feaf6d003

> - **Source:** EUR-Lex, CELEX `32022R0030` — <https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R0030>

( 1 ) OJ L 153, 22.5.2014, p. 62 . ( 2 ) Cybersecurity of 5G networks – EU Toolbox of risk mitigating measures, 29 January 2020. https://ec.europa.eu/digital-singlemarket/en/nis-cooperation-group

OJ L 153, 22.5.2014, p. 62 . ( 2 ) Cybersecurity of 5G networks – EU Toolbox of risk mitigating measures, 29 January 2020. https://ec.europa.eu/digital-singlemarket/en/nis-cooperation-group ( 3 ) Directive (EU) 2018/1972 of the European Par

( 2 ) Cybersecurity of 5G networks – EU Toolbox of risk mitigating measures, 29 January 2020. https://ec.europa.eu/digital-singlemarket/en/nis-cooperation-group

> **Primary source. Quote regulation wording from this file, not from summaries or the web.** > > - **Source:** EUR-Lex, CELEX `32023R2444` — <https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2444>

> > - **Source:** EUR-Lex, CELEX `32023R2444` — <https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2444> > - **Retrieved:** 2026-07-22 · SHA-256 of retrieved HTML: `e987e9fdeae9e3acfd6db1f9ed4e49da773b30fda07aca37897ccdaa

> - **Source:** EUR-Lex, CELEX `32023R2444` — <https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2444>

( 2 ) Commission Delegated Regulation (EU) 2022/30 of 29 October 2021 supplementing Directive 2014/53/EU of the European Parliament and of the Council with regard to the application of the essential requirements referred to in Article 3(3),

( 3 ) Commission Implementing Decision C(2022) 5637 of 5 August 2022 on a standardisation request to the European Committee for Standardisation and the European Committee for Electrotechnical Standardisation as regards radio equipment in su

ELI: http://data.europa.eu/eli/reg_del/2023/2444/oj

> **Primary source. Quote regulation wording from this file, not from summaries or the web.** > > - **Source:** EUR-Lex, CELEX `32014L0053` — <https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32014L0053>

> > - **Source:** EUR-Lex, CELEX `32014L0053` — <https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32014L0053> > - **Retrieved:** 2026-07-22 · SHA-256 of retrieved HTML: `396ee49b322c5925d457c2cc995e5580f736d2dd61dbc045a4551f34

> - **Source:** EUR-Lex, CELEX `32014L0053` — <https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32014L0053>

> **Primary source. Quote regulation wording from this file, not from summaries or the web.** > > - **Source:** EUR-Lex, CELEX `32025D0138` — <https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025D0138>

> > - **Source:** EUR-Lex, CELEX `32025D0138` — <https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025D0138> > - **Retrieved:** 2026-07-22 · SHA-256 of retrieved HTML: `d23810e60a254f02713d7c333d172addfd9532743befc32295a8554a

> - **Source:** EUR-Lex, CELEX `32025D0138` — <https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025D0138>

Ursula VON DER LEYEN ( 1 ) OJ L 316, 14.11.2012, p. 12 , ELI: http://data.europa.eu/eli/reg/2012/1025/oj .

( 1 ) OJ L 316, 14.11.2012, p. 12 , ELI: http://data.europa.eu/eli/reg/2012/1025/oj . ( 2 ) Directive 2014/53/EU of the European Parliament and of the Council of 16 April 2014 on the harmonisation of the laws of the Member States relating t

OJ L 316, 14.11.2012, p. 12 , ELI: http://data.europa.eu/eli/reg/2012/1025/oj .

( 2 ) Directive 2014/53/EU of the European Parliament and of the Council of 16 April 2014 on the harmonisation of the laws of the Member States relating to the making available on the market of radio equipment and repealing Directive 1999/5

( 3 ) Commission Implementing Decision C(2022)5637 of 5 August 2022 on a standardisation request to the European Committee for Standardisation and the European Committee for Electrotechnical Standardisation as regards radio equipment in sup

( 4 ) Commission Delegated Regulation (EU) 2022/30 of 29 October 2021 supplementing Directive 2014/53/EU of the European Parliament and of the Council with regard to the application of the essential requirements referred to in Article 3(3),

( 5 ) Commission Implementing Decision (EU) 2022/2191 of 8 November 2022 on the harmonised standards for radio equipment drafted in support of Directive 2014/53/EU of the European Parliament and of the Council ( OJ L 289, 10.11.2022, p. 7 ,

Notice 2: This harmonised standard does not confer a presumption of conformity with the essential requirement set out in Article 3(3), first subparagraph, point (f), of Directive 2014/53/EU if, when applying its clauses 6.2.5.1 and 6.2.5.2,

Notice 3: As regards the assessment criteria set out in clause 6.3.2.4 of this harmonised standard, this harmonised standard does not confer a presumption of conformity with the essential requirement set out in Article 3(3), first subparagr

ELI: http://data.europa.eu/eli/dec_impl/2025/138/oj

On 30 July 2026, ENISA published an official *Secure by Design and Default Playbook: A Practical Guide to Secure by Design and Default for SMEs*, distributed as a GitHub repository under CC BY 4.0: [github.com/enisaeu/enisa-sbd-playbook](ht

Four categories of vendor can hold a certification: silicon vendors, system software providers, IP providers, and device manufacturers — reflecting that a device's security posture is assembled from all four layers, not just the finished pr

**Source:** [psacertified.org](https://www.psacertified.org/) — scheme documents, certified-product database, and evaluation-lab directory are at [psacertified.org/development-resources](https://www.psacertified.org/development-resources/) 

**Everything below is invented for illustration.** The device name, component names and versions, hashes, checksums, and the CVE ID in the VEX example are all fictional placeholders — none of it describes a real product, and the CVE ID is n

"source": {         "name": "NVD",         "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-99999"

"name": "NVD",         "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-99999"       },

"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-99999"

"SPDXID": "SPDXRef-DOCUMENT",   "name": "example-iot-gateway-2.4.0",   "documentNamespace": "https://example.com/spdx/example-iot-gateway-2.4.0-3e671687",

"name": "example-iot-gateway-2.4.0",   "documentNamespace": "https://example.com/spdx/example-iot-gateway-2.4.0-3e671687",   "creationInfo": {

"documentNamespace": "https://example.com/spdx/example-iot-gateway-2.4.0-3e671687",

"name": "mbedtls",       "versionInfo": "3.6.0",       "downloadLocation": "https://github.com/Mbed-TLS/mbedtls",

"versionInfo": "3.6.0",       "downloadLocation": "https://github.com/Mbed-TLS/mbedtls",       "licenseConcluded": "Apache-2.0",

"downloadLocation": "https://github.com/Mbed-TLS/mbedtls",

"name": "FreeRTOS",       "versionInfo": "10.6.2",       "downloadLocation": "https://github.com/FreeRTOS/FreeRTOS-Kernel",

"versionInfo": "10.6.2",       "downloadLocation": "https://github.com/FreeRTOS/FreeRTOS-Kernel",       "licenseConcluded": "MIT",

"downloadLocation": "https://github.com/FreeRTOS/FreeRTOS-Kernel",

"name": "lwIP",       "versionInfo": "2.2.0",       "downloadLocation": "https://savannah.nongnu.org/projects/lwip/",

"versionInfo": "2.2.0",       "downloadLocation": "https://savannah.nongnu.org/projects/lwip/",       "licenseConcluded": "BSD-3-Clause",

"downloadLocation": "https://savannah.nongnu.org/projects/lwip/",

**Source:** structure checked against the [CycloneDX 1.6/1.7 JSON schema](https://cyclonedx.org/docs/1.6/json/) and standard SPDX 2.3 JSON usage as documented at [spdx.dev](https://spdx.dev/use/examples/); see [`formats-and-specifications.m

Full text: [2026 CISA Minimum Elements for SBOM (PDF)](https://www.cisa.gov/sites/default/files/2026-07/2026_cisa_sbom_minimum_elements_508c.pdf).

ENISA's *[SBOM Adoption State of Play — 2026](https://www.enisa.europa.eu/publications/sbom-adoption-state-of-play-2026)* (published 9 June 2026 — a survey of 334 organisations, 65% EU-based, 80% directly affected by the CRA) found that 78%

This page explains what CycloneDX and SPDX are; it doesn't show what a file in either format actually looks like. For that, see [`examples.md`](examples.md) — a hand-built, schema-checked example of the same hypothetical device's SBOM writt

CRA Annex I, Part II, point 1 requires manufacturers to identify and document vulnerabilities and components, "including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least th

**Source:** [cyclonedx.org/specification/overview](https://cyclonedx.org/specification/overview), [spdx.dev/about/overview](https://spdx.dev/about/overview/), [ISO/IEC 19770-2:2015](https://www.iso.org/standard/65666.html), [2026 CISA Minim

**Source:** [cyclonedx.org/capabilities/vex](https://cyclonedx.org/capabilities/vex/), [OASIS CSAF 2.0 specification](https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html), [ISO/IEC 20153:2025](https://www.iso.org/standard/89986.