Interactive assessment of the requirement clauses of 17 draft ETSI harmonized vertical standards under the Cyber Resilience Act (Annex I Part I).
Views
| Section | Content |
|---|---|
| §1 Overview | Corpus stats, noteworthy findings, standards table (version, applicability model, complexity) |
| §2 Coverage | Standard × essential-requirement heatmap; zero cells flagged; corpus-wide ER density |
| §3 Overlap | Force-directed similarity network (TF-IDF cosine ≥ 0.70 edges); 73 near-duplicate clusters (≥ 0.80) |
| §4 Complexity | Composite 0–10 score from length, conditionals, cross-references, multi-obligation structure |
| §5 Register | Full-text search over all 1,404 requirements; filters by standard, ER, topic, complexity |
tools/parse.py parses the compiled source text (10 distinct drafting formats across the 17
standards) into structured JSON. tools/analyze.py computes topic tags, TF-IDF overlap
clusters, complexity metrics, and the ER coverage matrix, then emits data.js.
python3 tools/parse.py # reads data/Requirements_.txt, writes data/reqs_raw.json
python3 tools/analyze.py # reads data/reqs_raw.json, writes data.js
- The duplicated Operating Systems block in the source (EN 304 626 appears twice, near-identical) was excluded once.
- EN 304 642 (Telecom Network Functions) contains only conformance-by-reference entries; these are tagged
kind=referenceand excluded from text-similarity overlap. - ER mapping uses the explicit "addresses the requirements in the CRA Annex I Part I (x)(y)" statements where present, with section-title keyword fallback otherwise. ~10 requirements remain unmapped.
- Complexity is a heuristic proxy for assessment effort, not a normative measure.
- Similarity is lexical (TF-IDF cosine); semantically equivalent but differently worded requirements will score lower.
This material is provided "as is", for information purposes only. It is an unofficial, largely automated analysis of draft standards that are not final and have not been cited in the Official Journal of the European Union. Drafts change; extraction and scoring are heuristic and will contain errors and omissions.
Nothing here constitutes legal, regulatory, or compliance advice, and it must not be relied upon to determine conformity with the Cyber Resilience Act or any other obligation. No representation or warranty is given as to accuracy, completeness, currency, or fitness for any purpose, and CrabNebula and the contributors accept no liability whatsoever for any loss or damage arising from use of or reliance on this material. The published ETSI standards and the CRA text itself remain the only authoritative sources.
Licensed under CC BY 4.0. You may share and adapt this material, including commercially, provided you give appropriate credit. See LICENSE.
The underlying ETSI draft standards are the property of ETSI and are not covered by this license.