f23ae32077
User-Reframe: nicht „naechste Regulierung", sondern erster MULTI-REGULATION-Reuse-Test. - obligations/cra_machinery.json: 31 MaschVO-Obligations (25 LM = Anhang-III-Essential-Reqs rechtlich legit + 6 BP). Pipeline 2229->1096 micro->120 review-units->Opus. out_of_scope 41 RU (AI-Act/DSGVO/Common-Criteria/Banking/...). - obligations/machinery_reuse_metrics.json: ERSTE Reuse-KPI. **NEUE OBJEKTKLASSEN = 0** (Architektur-Freeze haelt gegen physische-Safety-Regulierung — empirisch). 39% Reuse / 61% net-new; Capability-Reuse 2 (Cyber-Safety-Bruecke: access_control_safety_functions->access, protection_against_corruption->integrity/tamper), Procedure-Reuse 6, Evidence-Reuse 2, CORE-Spezialisierung 2 (risk_assessment->update_risk_assessment, conformity->sbom_tech_doc). - join_keys 95->126 (machinery 31). precluster.py: machinery-Scope. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
1144 lines
27 KiB
JSON
1144 lines
27 KiB
JSON
{
|
|
"schema_version": "obligation_join_keys_v1",
|
|
"contract": "obligation_id ist der stabile Join-Key. Legal Knowledge Graph haengt citation_spans an obligation_id; Compliance Execution Graph mappt control_mapping.source_norm -> obligation_id. Interim-Bruecke = citation_units. obligation_id NIE neu vergeben (re-link).",
|
|
"count": 126,
|
|
"obligation_ids": [
|
|
{
|
|
"obligation_id": "sbom_creation",
|
|
"regulation": "CRA",
|
|
"family": "sbom",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Annex I Part II (1)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "sbom_dependency_coverage",
|
|
"regulation": "CRA",
|
|
"family": "sbom",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Art. 3(36) i.V.m. Annex I Part II (1)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "sbom_format_standard",
|
|
"regulation": "CRA",
|
|
"family": "sbom",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Annex I Part II (1)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "sbom_maintenance_update",
|
|
"regulation": "CRA",
|
|
"family": "sbom",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Annex I Part II (1)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "sbom_completeness_verification",
|
|
"regulation": "CRA",
|
|
"family": "sbom",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "sbom_tooling_automation",
|
|
"regulation": "CRA",
|
|
"family": "sbom",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "IMPLEMENTATION"
|
|
},
|
|
{
|
|
"obligation_id": "sbom_access_provision",
|
|
"regulation": "CRA",
|
|
"family": "sbom",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "sbom_authority_provision",
|
|
"regulation": "CRA",
|
|
"family": "sbom",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Art. 31 / Annex I Part II (1)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "sbom_confidentiality",
|
|
"regulation": "CRA",
|
|
"family": "sbom",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Art. 31(4)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "sbom_supply_chain_contracts",
|
|
"regulation": "CRA",
|
|
"family": "sbom",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "sbom_technical_documentation",
|
|
"regulation": "CRA",
|
|
"family": "sbom",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Art. 31 i.V.m. Annex VII"
|
|
],
|
|
"source_role": "EVIDENCE"
|
|
},
|
|
{
|
|
"obligation_id": "vuln_identification_inventory",
|
|
"regulation": "CRA",
|
|
"family": "vuln",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Annex I Part II (1)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "vuln_assessment_prioritization",
|
|
"regulation": "CRA",
|
|
"family": "vuln",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Annex I Part II (1)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "vuln_remediation_patching",
|
|
"regulation": "CRA",
|
|
"family": "vuln",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Annex I Part II (2) & (8)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "vuln_handling_process",
|
|
"regulation": "CRA",
|
|
"family": "vuln",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Article 13(8) & Annex VII"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "coordinated_vulnerability_disclosure",
|
|
"regulation": "CRA",
|
|
"family": "vuln",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Annex I Part II (5)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "exploited_vuln_reporting_authorities",
|
|
"regulation": "CRA",
|
|
"family": "vuln",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Article 14 & Article 16"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "vuln_info_dissemination_users",
|
|
"regulation": "CRA",
|
|
"family": "vuln",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Annex I Part II (4) & (6)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "attack_surface_minimization",
|
|
"regulation": "CRA",
|
|
"family": "core",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Annex I Part I (2)(j)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "software_integrity_protection",
|
|
"regulation": "CRA",
|
|
"family": "core",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Annex I Part I (2)(f)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "user_authentication_required",
|
|
"regulation": "CRA",
|
|
"family": "authentication",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Annex I (2)(d)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "authentication_policy_documented",
|
|
"regulation": "CRA",
|
|
"family": "authentication",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "auth_exceptions_documented",
|
|
"regulation": "CRA",
|
|
"family": "authentication",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "mfa_required",
|
|
"regulation": "CRA",
|
|
"family": "authentication",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "step_up_authentication",
|
|
"regulation": "CRA",
|
|
"family": "authentication",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "privileged_op_reauth",
|
|
"regulation": "CRA",
|
|
"family": "authentication",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "strong_crypto_authentication",
|
|
"regulation": "CRA",
|
|
"family": "authentication",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Annex I (2)(e)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "credential_lifecycle_management",
|
|
"regulation": "CRA",
|
|
"family": "authentication",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "credential_confidentiality_protection",
|
|
"regulation": "CRA",
|
|
"family": "authentication",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Annex I (2)(e)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "password_policy",
|
|
"regulation": "CRA",
|
|
"family": "authentication",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "no_default_credentials",
|
|
"regulation": "CRA",
|
|
"family": "authentication",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Annex I (2)(a)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "account_lockout_failed_attempts",
|
|
"regulation": "CRA",
|
|
"family": "authentication",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "server_side_validation",
|
|
"regulation": "CRA",
|
|
"family": "authentication",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "session_binding_management",
|
|
"regulation": "CRA",
|
|
"family": "authentication",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "reauth_after_inactivity",
|
|
"regulation": "CRA",
|
|
"family": "authentication",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "token_validation_lifecycle",
|
|
"regulation": "CRA",
|
|
"family": "authentication",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "mutual_authentication",
|
|
"regulation": "CRA",
|
|
"family": "authentication",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "revocation_check",
|
|
"regulation": "CRA",
|
|
"family": "authentication",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "encrypted_auth_channel",
|
|
"regulation": "CRA",
|
|
"family": "authentication",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Annex I (2)(e)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "tls_certificate_auth",
|
|
"regulation": "CRA",
|
|
"family": "authentication",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "service_to_service_auth",
|
|
"regulation": "CRA",
|
|
"family": "authentication",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "auth_key_management",
|
|
"regulation": "CRA",
|
|
"family": "authentication",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "biometric_authentication",
|
|
"regulation": "CRA",
|
|
"family": "authentication",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "federated_auth_assertions",
|
|
"regulation": "CRA",
|
|
"family": "authentication",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "separate_authn_authz",
|
|
"regulation": "CRA",
|
|
"family": "authentication",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "remote_access_authentication",
|
|
"regulation": "CRA",
|
|
"family": "authentication",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "supplier_access_auth",
|
|
"regulation": "CRA",
|
|
"family": "authentication",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "personal_admin_accounts",
|
|
"regulation": "CRA",
|
|
"family": "authentication",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "firmware_software_authentication",
|
|
"regulation": "CRA",
|
|
"family": "authentication",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Annex I (2)(c)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "event_logging_security_events",
|
|
"regulation": "CRA",
|
|
"family": "logging",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Annex I Part I (2)(k)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "access_control_event_logging",
|
|
"regulation": "CRA",
|
|
"family": "logging",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Annex I Part I (2)(k)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "audit_trail_admin_actions",
|
|
"regulation": "CRA",
|
|
"family": "logging",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Annex I Part I (2)(k)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "log_integrity_immutability",
|
|
"regulation": "CRA",
|
|
"family": "logging",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Annex I Part I (2)(k)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "log_access_control_protection",
|
|
"regulation": "CRA",
|
|
"family": "logging",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Annex I Part I (2)(k)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "log_retention_archival",
|
|
"regulation": "CRA",
|
|
"family": "logging",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "centralized_log_management",
|
|
"regulation": "CRA",
|
|
"family": "logging",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "log_monitoring_alerting",
|
|
"regulation": "CRA",
|
|
"family": "logging",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Annex I Part I (2)(k)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "log_data_minimization_privacy",
|
|
"regulation": "CRA",
|
|
"family": "logging",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "log_format_standardization",
|
|
"regulation": "CRA",
|
|
"family": "logging",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "log_timestamp_synchronization",
|
|
"regulation": "CRA",
|
|
"family": "logging",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "logging_availability_resilience",
|
|
"regulation": "CRA",
|
|
"family": "logging",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "logging_thread_safety_correctness",
|
|
"regulation": "CRA",
|
|
"family": "logging",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "IMPLEMENTATION"
|
|
},
|
|
{
|
|
"obligation_id": "logging_library_supply_chain",
|
|
"regulation": "CRA",
|
|
"family": "logging",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "logging_config_management",
|
|
"regulation": "CRA",
|
|
"family": "logging",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "logging_governance_roles",
|
|
"regulation": "CRA",
|
|
"family": "logging",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "incident_response_logging",
|
|
"regulation": "CRA",
|
|
"family": "logging",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "log_transmission_security",
|
|
"regulation": "CRA",
|
|
"family": "logging",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "network_traffic_logging",
|
|
"regulation": "CRA",
|
|
"family": "logging",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "remote_access_control_least_privilege",
|
|
"regulation": "CRA",
|
|
"family": "remote_access",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Annex I (1)(2)(d)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "remote_access_confidentiality_integrity",
|
|
"regulation": "CRA",
|
|
"family": "remote_access",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Annex I (1)(2)(b)(c)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "remote_session_management",
|
|
"regulation": "CRA",
|
|
"family": "remote_access",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "remote_access_mfa",
|
|
"regulation": "CRA",
|
|
"family": "remote_access",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "remote_access_encryption",
|
|
"regulation": "CRA",
|
|
"family": "remote_access",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "reject_insecure_remote_protocols",
|
|
"regulation": "CRA",
|
|
"family": "remote_access",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "remote_access_logging_audit",
|
|
"regulation": "CRA",
|
|
"family": "remote_access",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Annex I (1)(2)(g)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "remote_access_user_validation_ot",
|
|
"regulation": "CRA",
|
|
"family": "remote_access",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "remote_access_training",
|
|
"regulation": "CRA",
|
|
"family": "remote_access",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "remote_access_architecture_design",
|
|
"regulation": "CRA",
|
|
"family": "remote_access",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "remote_access_attack_surface_min",
|
|
"regulation": "CRA",
|
|
"family": "remote_access",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Annex I (1)(2)(a)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "remote_access_vuln_patch_mgmt",
|
|
"regulation": "CRA",
|
|
"family": "remote_access",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Annex I (2)(1)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "remote_access_threat_detection",
|
|
"regulation": "CRA",
|
|
"family": "remote_access",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "remote_maintenance_governance",
|
|
"regulation": "CRA",
|
|
"family": "remote_access",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "temporary_remote_access_mgmt",
|
|
"regulation": "CRA",
|
|
"family": "remote_access",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "remote_access_data_export_protection",
|
|
"regulation": "CRA",
|
|
"family": "remote_access",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "component_remote_interface_security",
|
|
"regulation": "CRA",
|
|
"family": "remote_access",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "remote_access_fallback_concept",
|
|
"regulation": "CRA",
|
|
"family": "remote_access",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "provide_security_updates",
|
|
"regulation": "CRA",
|
|
"family": "updates",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Annex I (2)(c)",
|
|
"Art. 13"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "support_period_maintenance",
|
|
"regulation": "CRA",
|
|
"family": "updates",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Art. 13(8)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "signed_update_integrity",
|
|
"regulation": "CRA",
|
|
"family": "updates",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Annex I (1)(3)(f)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "trusted_update_source",
|
|
"regulation": "CRA",
|
|
"family": "updates",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Annex I (1)(3)(d)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "update_testing_validation",
|
|
"regulation": "CRA",
|
|
"family": "updates",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "update_rollback",
|
|
"regulation": "CRA",
|
|
"family": "updates",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "automatic_updates_optout",
|
|
"regulation": "CRA",
|
|
"family": "updates",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Annex I (2)(c)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "update_risk_assessment",
|
|
"regulation": "CRA",
|
|
"family": "updates",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Annex I (1)(2)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "secure_modification_control",
|
|
"regulation": "CRA",
|
|
"family": "updates",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "IMPLEMENTATION"
|
|
},
|
|
{
|
|
"obligation_id": "risk_assessment_machinery_lifecycle",
|
|
"regulation": "MaschVO",
|
|
"family": "machinery",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Anhang III Nr. 1 (Allgemeine Grundsätze)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "risk_assessment_documentation",
|
|
"regulation": "MaschVO",
|
|
"family": "machinery",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Anhang IV (Technische Unterlagen)"
|
|
],
|
|
"source_role": "EVIDENCE"
|
|
},
|
|
{
|
|
"obligation_id": "risk_assessment_methodology_competence",
|
|
"regulation": "MaschVO",
|
|
"family": "machinery",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "residual_risk_management",
|
|
"regulation": "MaschVO",
|
|
"family": "machinery",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Anhang III Nr. 1.1.2 (Grundsätze für die Integration der Sicherheit)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "guards_protective_devices",
|
|
"regulation": "MaschVO",
|
|
"family": "machinery",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Anhang III Nr. 1.4 (Anforderungen an Schutzeinrichtungen)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "emergency_stop_interlocking",
|
|
"regulation": "MaschVO",
|
|
"family": "machinery",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Anhang III Nr. 1.2.4 (Stillsetzen, Not-Halt)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "safety_functions_design",
|
|
"regulation": "MaschVO",
|
|
"family": "machinery",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Anhang III Nr. 1.2.1 (Sicherheit und Zuverlässigkeit von Steuerungen)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "safety_components_conformity",
|
|
"regulation": "MaschVO",
|
|
"family": "machinery",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Anhang I (Liste der Sicherheitsbauteile), Art. 5"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "operating_instructions",
|
|
"regulation": "MaschVO",
|
|
"family": "machinery",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Anhang III Nr. 1.7.4 (Betriebsanleitung)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "blocking_release_procedure",
|
|
"regulation": "MaschVO",
|
|
"family": "machinery",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Anhang III Nr. 1.3.7/1.7.4"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "conformity_assessment",
|
|
"regulation": "MaschVO",
|
|
"family": "machinery",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Art. 25 (Konformitätsbewertungsverfahren)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "technical_documentation",
|
|
"regulation": "MaschVO",
|
|
"family": "machinery",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Anhang IV (Technische Unterlagen)"
|
|
],
|
|
"source_role": "EVIDENCE"
|
|
},
|
|
{
|
|
"obligation_id": "eu_declaration_ce_marking",
|
|
"regulation": "MaschVO",
|
|
"family": "machinery",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Art. 21, Art. 22 (EU-Konformitätserklärung, CE-Kennzeichnung)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "manufacturer_economic_operator_obligations",
|
|
"regulation": "MaschVO",
|
|
"family": "machinery",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Art. 10, Art. 11 (Pflichten der Hersteller)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "essential_safety_requirements_compliance",
|
|
"regulation": "MaschVO",
|
|
"family": "machinery",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Anhang III (Grundlegende Sicherheits- und Gesundheitsschutzanforderungen)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "harmonised_standards_selection",
|
|
"regulation": "MaschVO",
|
|
"family": "machinery",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "notified_body_requirements",
|
|
"regulation": "MaschVO",
|
|
"family": "machinery",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Kapitel IV (Notifizierung von Konformitätsbewertungsstellen)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "market_surveillance_safeguard",
|
|
"regulation": "MaschVO",
|
|
"family": "machinery",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Kapitel V/VI (Marktüberwachung, Schutzklauselverfahren)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "sanctions",
|
|
"regulation": "MaschVO",
|
|
"family": "machinery",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Art. 50 (Sanktionen)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "scope_transition_application",
|
|
"regulation": "MaschVO",
|
|
"family": "machinery",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Art. 1, Art. 53, Art. 54 (Anwendungsbereich, Übergangsbestimmungen, Geltungsbeginn)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "modification_substantial_change",
|
|
"regulation": "MaschVO",
|
|
"family": "machinery",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Art. 18 (wesentliche Veränderung)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "access_control_safety_functions",
|
|
"regulation": "MaschVO",
|
|
"family": "machinery",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Anhang III Nr. 1.1.9 (Schutz gegen Korrumpierung)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "protection_against_corruption",
|
|
"regulation": "MaschVO",
|
|
"family": "machinery",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Anhang III Nr. 1.1.9, Nr. 1.2.1"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "ml_safety_components",
|
|
"regulation": "MaschVO",
|
|
"family": "machinery",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Anhang I Teil A, Anhang III Nr. 1.2.1"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "autonomous_mobile_machinery",
|
|
"regulation": "MaschVO",
|
|
"family": "machinery",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Anhang III Nr. 3 (Mobile Maschinen) / Nr. 6"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "specific_machine_types",
|
|
"regulation": "MaschVO",
|
|
"family": "machinery",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Anhang III Nr. 2-6 (besondere Maschinenkategorien)"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "vibration_noise_emission",
|
|
"regulation": "MaschVO",
|
|
"family": "machinery",
|
|
"tier": "LEGAL_MINIMUM",
|
|
"citation_units": [
|
|
"Anhang III Nr. 1.5.8/1.5.9, Nr. 1.7.4.2"
|
|
],
|
|
"source_role": "LEGAL_BASIS"
|
|
},
|
|
{
|
|
"obligation_id": "verification_inspection_maintenance",
|
|
"regulation": "MaschVO",
|
|
"family": "machinery",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "quality_management_system",
|
|
"regulation": "MaschVO",
|
|
"family": "machinery",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "long_term_availability_updates",
|
|
"regulation": "MaschVO",
|
|
"family": "machinery",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
},
|
|
{
|
|
"obligation_id": "security_functions_default_free",
|
|
"regulation": "MaschVO",
|
|
"family": "machinery",
|
|
"tier": "BEST_PRACTICE",
|
|
"citation_units": [],
|
|
"source_role": "GUIDANCE"
|
|
}
|
|
]
|
|
} |