Hi everyone,
I'm writing to draw your attention to the proposal presented at the CRA Attestation meeting titled
"Enisa playbook Secure by Design and Default guidance" You can view the full PR here:
https://github.com/orcwg/cra-attestations/pull/40.This proposal introduces a separate, versioned catalogue that acts as a practical guide for how a project can meet the Light-Weight template items and what evidence manufacturers can expect. It draws heavily from the ENISA Secure by Design and Default Playbook v1.0.
Key points of the proposal:- Stable Attestations: Template items remain stable while the catalogue can evolve to reflect changing guidance.
- Automatable Evaluation: Concrete measures and defined evidence levels (E1, E2, E3) facilitate automated ingestion and evaluation of attestations by manufacturers.
- No New Obligations: The catalogue is purely guidance; maintainers are not obliged to adopt any of the measures.
- Two-Tier Approach: The catalogue maintains the Light-Weight and Heavy-Weight tiers, with the Heavy-Weight measures serving as an interim solution until harmonised CRA standards are available.
The PR outlines specific measures for both Light-Weight (e.g., Security Contact, Vulnerability Publishing, SBOMs) and Heavy-Weight (e.g., Threat Modelling, Build Provenance) tiers, including baseline and enhanced options, as well as the expected evidence.
We need your input!Please review the PR and share your thoughts and feedback on the GitHub thread or directly in the mailing list. Your participation is crucial as we shape this important resource.
Best regards,
Juan
