GLOSSARY
Terms used in CRA readiness and system safety work.
Short, verifiable definitions for the terms that recur across CRA compliance, functional safety and product security engineering, each with the practical detail behind the definition.
- ASILAutomotive Safety Integrity Level
- ASIL is a risk classification defined in ISO 26262 that expresses the rigour of safety measures required for an automotive function, ranging from QM to ASIL D.
- CE marking
- CE marking is the manufacturer's declaration that a product complies with all applicable EU legislation, including the Cyber Resilience Act once its essential requirements apply.
- Conformity assessment
- Conformity assessment is the procedure by which a manufacturer demonstrates that a product meets applicable legal requirements before it is placed on the market.
- CVECommon Vulnerabilities and Exposures
- A CVE is a unique public identifier assigned to a specific software or hardware vulnerability, used to reference the same issue consistently across tools, advisories and reports.
- Hazard analysis
- Hazard analysis is the systematic identification of ways a system can cause harm, forming the basis for safety requirements, risk classification and the resulting safety case.
- Important product with digital elements
- Under the CRA, an important product with digital elements is one whose core function carries elevated cybersecurity risk, requiring stricter conformity assessment than default products.
- Notified body
- A notified body is an independent conformity assessment organisation designated by an EU member state and authorised to assess products against specific legislation, including parts of the CRA.
- Product with digital elements
- A product with digital elements is any software or hardware product, and its remote data processing solutions, placed on the market with a direct or indirect logical or data connection to a device or network.
- SBOMSoftware Bill of Materials
- An SBOM is a structured inventory of the components, including third-party and open-source dependencies, used to build a software product, used to track provenance and known vulnerabilities.
- Safety case
- A safety case is a structured argument, supported by evidence, that a system is acceptably safe for a specific use in a specific context.
- Secure development lifecycle
- A secure development lifecycle is a defined set of security activities integrated into each phase of product development, from requirements through design, implementation, testing and maintenance.
- SILSafety Integrity Level
- SIL, defined in IEC 61508, is a discrete level expressing the probability that a safety function will perform as required, used to set the rigour of design and verification measures.
- Support period
- The support period is the length of time a manufacturer commits to providing security updates for a product with digital elements, which the CRA requires be appropriate to the product's expected lifetime.
- TARAThreat Analysis and Risk Assessment
- TARA is a structured method for identifying cybersecurity threats to a system, assessing their impact and attack feasibility, and deriving proportionate security requirements.
- Traceability
- Traceability is the documented, verifiable linkage between a hazard or risk, the requirement written to control it, the design that implements it, and the verification that confirms it.
- Vulnerability disclosure policy
- A vulnerability disclosure policy is a published statement describing how a manufacturer accepts, handles and responds to reports of security vulnerabilities in its products.