Skip to main content

Guide: Assembling Your Audit Evidence Pack

An Audit Evidence Pack is a structured collection of documents, records, and technical artefacts that demonstrates your product's compliance with a given regulation. For the Cyber-Resilience Act (CRA), this pack constitutes the technical documentation that manufacturers are legally required to maintain and provide to market surveillance authorities upon request (CRA Art. 31).

This is not a one-time task but a "living" collection of evidence that must be updated throughout the product's lifecycle. This guide provides a template for organizing this information.

Goal: To be able to prove, at any time, that your product and processes meet your legal obligations.


Structure of the Evidence Pack

Your evidence pack should be organized logically, making it easy for an auditor or national authority to find the information they need. A good approach is to structure it around the product lifecycle: from high-level governance to specific technical implementation and operational records.

Section 1: Governance & Risk Management

This section contains your high-level policies and risk assessment artefacts.

  • Cybersecurity Risk Assessment: The foundational document outlining the product's intended use, key assets, identified threats, and risk mitigation strategies. This is the starting point for your entire security posture. ([CRA Annex I, Part I][cra_annexI_partI])
  • Secure Development Lifecycle (SDL) Policy: Your internal, documented process for how you build security into every stage of development. This should reference your CI/CD hardening practices. (CRA Annex I.II)
  • Vulnerability Handling Policy: Your public Coordinated Vulnerability Disclosure (CVD) policy and your internal procedures for triaging and managing reported vulnerabilities. (See CVD Guide)
  • Patch Management Policy: Your public commitment to providing security updates, including timelines based on severity. (See Patch Cadence Guide)

Section 2: Product Technical & User Documentation

This section details the product's design and the information provided to users.

  • Detailed Architecture Diagram: A diagram showing the product's key hardware and software components, network interfaces, security boundaries, and trust zones.
  • Hardware Root of Trust Specification: Documentation of the hardware used to anchor security (e.g., SE, TPM, TEE) and the process for protecting keys. (See Key Provisioning Guide)
  • Software Bill of Materials (SBOM): A complete, machine-readable SBOM (in SPDX or CycloneDX format) for the specific version of the software placed on the market. (CRA Annex I.I)
  • User Manual & Secure Configuration Guide: A copy of the instructions provided to the user, which must include guidance on secure use, the product's support period, and how to report vulnerabilities. (CRA Annex II)

Section 3: Security Verification & Validation

This section contains the proof that your security controls work as intended.

  • Security Test Reports: Reports from all internal and third-party security testing activities, such as penetration testing, code audits, and hardware security analysis.
  • Automated Scan Results: A summary of the latest reports from the automated security tools in your CI/CD pipeline (SAST, SCA, secrets scanning).
  • Conformity Assessment Documentation:
    • A copy of the signed EU Declaration of Conformity.
    • If applicable, the certificate and reports from the third-party Notified Body that performed your audit.

Section 4: Post-Market & Operational Records

This section contains ongoing records generated after the product is on the market.

  • Vulnerability Log: A complete log of all vulnerabilities reported and discovered, including their source, triage status, severity score, and final resolution.
  • Patch Log: A record of all security patches released, including the release date, CVEs addressed, and the firmware version that contains the fix.
  • Incident Response Records: If you have experienced a breach or an actively exploited vulnerability, this includes copies of the notification reports sent to ENISA and/or other authorities. (CRA Art. 14)

This guide provides a template for the technical documentation required under the CRA. Use it to build a comprehensive and auditable evidence pack.