CN CRA NotebookCRA 閱讀筆記
Working note — actively evolving, may be revised. See /errata for change log. 推進中的筆記,可能持續修改。修訂紀錄見 /errata
Last reviewed 27 Apr 2026最後校閱 2026-04-27 · 10 min read閱讀 10 分鐘 · Mental model心智模型 · Working書寫

Why PRE eats more than its share. PRE 階段吃掉的,比它的份額還多。

prEN 40000-1-3 has twenty-five requirements. The preparation phase carries ten of them — exactly forty percent. Measure the actual implementation work, and the preparation phase looks heavier than its requirement count suggests, closer to two-thirds. Three structural reasons sit behind that asymmetry, and they decide how an APAC manufacturer should sequence the CRA-13 build-out from now until December 2027. prEN 40000-1-3 共 25 個 requirement。準備階段佔 10 個——恰好 40%。但量測實作工作量、準備階段比 requirement 數量看起來還更重,更接近三分之二。三個結構性原因撐起這個不對稱,也決定了 APAC 製造商從現在到 2027 年 12 月該怎麼排序 CRA-13 的建構工作。

The first time I tried to build a project plan against prEN 40000-1-3 I made the obvious mistake. I divided the work into six phases, allocated proportional time to each, and walked into the first sprint expecting Preparation to be slightly heavier than the others — six requirements out of twenty-five would have meant 24%, ten out of twenty-five means 40%. The plan held for about two weeks. By the time the SBOM tooling decision was being argued in design review, the original allocation had quietly fallen apart. The Preparation phase wasn’t 40% of the work. It was closer to two-thirds.

This essay is about why. Three structural reasons sit underneath the asymmetry, and they all point in the same direction: PRE is the phase you cannot postpone, and that property compounds.

§ 01The numbers, before the argument

Twenty-five requirements across six phases. The distribution is uneven by design — the standard’s authors did not pretend the phases were equal. Here is what the count actually looks like:

Phase Requirement IDs Count Share
[PRE] PreparationPRE-1 → PRE-101040%
[RCP] ReceiptRCP-1 → RCP-7728%
[VRF] VerificationVRF-1, VRF-228%
[RMD] RemediationRMD-1 → RMD-3312%
[RLS] ReleaseRLS-1, RLS-228%
[PRA] Post-releasePRA-114%
Total25100%

40% is the floor. It is what an honest count of paragraph-level requirements will give you. Anyone who wants to dispute the asymmetry has to dispute it from at least there. The argument that follows is why the implementation footprint runs heavier than the floor — three reasons, each independent of the others.

§ 02Reason one — Preparation cannot be retrofitted

Look at what PRE-7 and PRE-8 ask for: a software bill of materials and a hardware bill of materials. Look at what they presume about your engineering organisation. They presume that for every product you ship, you can produce a current, accurate inventory of every software component (with version, licence, and cryptographic hash) and every hardware component (with manufacturer, part number, and provenance). And they presume you can do that continuously, because RCP-3 and RCP-4 then ask you to map any newly disclosed CVE back to the products that contain the affected component.

That is not a document. That is a CI/CD integration. An SBOM produced by hand once a year is worthless under prEN 40000-1-3 because it desynchronises from the build the moment it is produced. To satisfy PRE-7 you have to wire CycloneDX or SPDX generation into your build pipeline, version-control the output, and treat it as an artefact alongside the binary. For most APAC ODMs that means changing how the build is wired — adding a dependency-tracking step, retraining the build engineers, and finding budget for a tool like Dependency Track or Anchore.

Compare that to RMD-2, “Remediation development”. RMD-2 is also non-trivial. But RMD-2 work happens per vulnerability, on demand, when something specific has surfaced through RCP and VRF. You can hire a contractor, accept a longer cycle time, escalate to senior engineers — there are flexibility levers. PRE-7 has no flexibility lever. Either your build produces an SBOM or it doesn’t. Either every release is covered or none are.

The same shape applies to PRE-1 (vulnerability handling policy), PRE-2 (CVD policy), PRE-3 (operational security), PRE-5 (secure communication), PRE-6 (product identification), PRE-9 (test and review planning), and PRE-10 (distribution mechanisms). Each of these is structural — once it’s in place the marginal cost per vulnerability drops to near zero, but if it isn’t in place the entire downstream pipeline jams. PRE is the load-bearing infrastructure. Everything else operates on top of it.

§ 03Reason two — Preparation produces persistent artefacts

Run through what each phase actually leaves behind in your evidence binder. PRE produces durable objects: a vulnerability handling policy, a CVD policy, an SBOM (regenerated every build), an HBOM, a product identification scheme, a security test and review plan, a list of distribution channels, a documented operational security regime. These are standing documents. A notified body or market surveillance authority assessing your Article 13(8) compliance will spend most of an audit reading these.

RCP produces traces: receipt logs, monitoring logs, periodic test reports, periodic review reports. These accumulate but each individual artefact is small. VRF produces one tracked, verified vulnerability report per vulnerability triaged. RMD produces a remediation decision, a developed fix, and a test report — also one set per vulnerability. RLS produces a security update binary plus a CSAF advisory — again, per vulnerability. PRA produces a brief retrospective per release.

The asymmetry is not just in count, it is in persistence. PRE artefacts are read every quarter and updated every release. RCP through PRA artefacts are written once per incident and then archived. The senior engineering hours that go into PRE artefacts are paid every cycle. The senior engineering hours that go into RMD artefacts are paid only when an actual vulnerability arrives. Auditors know this. They open audits with PRE.

§ 04Reason three — Preparation is the only proactive phase

Look at the phases through a different lens: which ones run on their own schedule, and which ones run on the schedule of an external event?

RCP, VRF, RMD, RLS, PRA all run on the schedule of vulnerabilities. They are reactive phases. They do not consume engineering capacity until a vulnerability surfaces, at which point they consume it intensely for a bounded period, and then they go quiet again. A team that ships a product without significant vulnerabilities for six months pays almost nothing in RCP/VRF/RMD/RLS/PRA cost during that window. The cost is real but it is event-driven.

PRE is the opposite. PRE runs on your release schedule. Every build regenerates an SBOM. Every product line update revisits product identification. Every quarter you review the test plan against PRE-9. The CVD policy gets renewed when staff turn over. The cost is continuous and unavoidable, regardless of whether any vulnerability is found.

That makes PRE the only phase whose cost is fixed and predictable. It also makes PRE the only phase you can actually finish ahead of an external event. RCP through PRA are forever — they continue for the entire support period. PRE has a moment of completion: the day your CI/CD produces a clean SBOM, the day your CVD policy is published, the day your secure communication channel works. After that, PRE shifts from a build cost to a maintenance cost.

This third reason is why the engineering organisations that handle CRA well sequence PRE first. They get past the initial spike of structural investment, and then they have capacity left for everything else. The organisations that try to do all six phases in parallel run out of capacity in their first real incident, because PRE infrastructure was supposed to be in place to absorb it and wasn’t.

§ 05What this means for sequencing

If 40% is the floor and the implementation footprint is closer to two-thirds, the calendar should reflect that.

2026 H1. Almost all of it goes to PRE. SBOM toolchain selected, integrated into CI/CD, validated on at least one product line. CVD policy drafted, reviewed by legal, published with a working contact channel (the security.txt + email alias both alive). Product identification scheme decided. Operational security regime documented. By the end of June, you should be able to point at every PRE-1 through PRE-10 deliverable and say “that one is real, here is the artefact, here is the process that maintains it.”

2026 Q3. Now you can afford RCP. Wire the CVE feeds. Subscribe to upstream advisories for every component the SBOM lists. Run the first regular test under RCP-6 and the first regular review under RCP-7. The receipt mechanism gets exercised against deliberately-crafted test reports. By 11 September, the reporting capability is alive and tested — which is what Article 14 asks for.

2026 Q4 onwards. VRF, RMD, RLS, PRA exist as documented procedures rather than functioning departments. They get exercised the first time a real vulnerability arrives. Until then, the engineering hours that would have gone to building these from scratch are instead going to the harder Annex I Part I work — secure-by-design, the construction obligations of Article 13 itself, the conformity assessment evidence binder for December 2027.

The organisations that get this sequencing wrong typically do one of two things. They allocate proportionally — six phases, six equal slices of the year — and end up with all six half-built when Article 14 activates. Or they sprint at all six in parallel because everything looks urgent, and they exhaust senior engineering capacity by mid-2026 with nothing complete. The shape that works is the one that respects the asymmetry: PRE first, RCP second, and the reactive phases last because they will be tested by reality before they are tested by audit.

40% on paper. Closer to two-thirds in practice. Plan accordingly.

第一次嘗試把 prEN 40000-1-3 排成專案計畫時、我犯了個顯而易見的錯。我把工作切成六個階段、給每個按比例分配時間、走進第一個衝刺時預期準備階段會比其他略重——六個 requirement 平均下來是 24%、十個就是 40%。計畫撐了大約兩週。等到 SBOM 工具決策被搬到設計審查上爭論時、原本的分配已經悄悄崩了。準備階段不是 40% 的工作量。它更接近三分之二。

這篇文章在說為什麼。三個結構性原因撐著這個不對稱、且它們指向同一個方向:PRE 是你不能延後的階段、這個性質會疊加。

§ 01數字先說、論證後說

六個階段、25 個 requirement。分布本來就不平均——標準起草者沒假裝這六個階段份量相等。實際數量長這樣:

階段 Requirement IDs 數量 占比
[PRE] 準備PRE-1 → PRE-101040%
[RCP] 接收RCP-1 → RCP-7728%
[VRF] 驗證VRF-1、VRF-228%
[RMD] 修復RMD-1 → RMD-3312%
[RLS] 發佈RLS-1、RLS-228%
[PRA] 發佈後PRA-114%
合計25100%

40% 是下限。誠實算段落等級的 requirement,就會得到這個數字。任何想反駁這個不對稱的人、至少要從 40% 起爭。下面這篇論證在說:為什麼實作層的工作量比這個下限還重——三個原因、各自獨立。

§ 02原因一——準備階段不能事後補

看 PRE-7 跟 PRE-8 在要什麼:一份軟體物料清單、一份硬體物料清單。看它們對你工程組織假設了什麼。它們假設你能為每個出貨產品產出當下、準確、含每個軟體元件(含版本、授權、密碼學雜湊值)的清單、跟每個硬體元件(含製造商、料號、來源)的清單。而且它們假設你能持續產出,因為 RCP-3 跟 RCP-4 會接著要你把任何新揭露的 CVE 反向對應到含有受影響元件的產品。

這不是文件。這是 CI/CD 整合。一年人工生一次的 SBOM 在 prEN 40000-1-3 之下沒有價值——它產出來那一刻就跟建置不同步了。要滿足 PRE-7、你必須把 CycloneDX 或 SPDX 的產出接進建置流程、把產出版本控、把它當成跟 binary 並排的成品。對多數 APAC ODM 來說、這意味著要改建置流程怎麼接、加上一個依賴追蹤步驟、訓練建置工程師、撥預算給像 Dependency Track 或 Anchore 之類的工具。

對比一下 RMD-2「修補開發」。RMD-2 也不簡單。但 RMD-2 的工作是每個弱點個別處理、按需求啟動、在 RCP 跟 VRF 篩出具體東西之後才開工。你可以外包、可以接受比較長的週期時間、可以升級給資深工程師——有迴旋空間。PRE-7 沒有迴旋空間。要嘛你的建置產 SBOM,要嘛不產。要嘛每次發行都涵蓋、要嘛全都沒涵蓋。

同樣的形狀適用於 PRE-1(弱點處理政策)、PRE-2(CVD 政策)、PRE-3(營運安全)、PRE-5(安全通訊)、PRE-6(產品識別)、PRE-9(測試與審查規劃)、PRE-10(散發機制)。每一個都是結構性的——一旦就位、每個弱點的邊際成本就降到接近零;但若沒就位、整個下游流程就卡住。PRE 是承重的基礎設施。其他階段都在它上面運作。

§ 03原因二——準備階段產出持久物件

把每個階段實際在你證據夾裡留下什麼東西攤開來看。PRE 產出持久存在的物件:一份弱點處理政策、一份 CVD 政策、一份 SBOM(每次建置重生)、一份 HBOM、一個產品識別架構、一份安全測試與審查計畫、一份散發通道清單、一份文件化的營運安全制度。這些都是常駐文件。公告機構或市場監督機關評鑑你的 Article 13(8) 符合性時、稽核大部分時間會在讀這些。

RCP 產出紀錄痕跡:接收紀錄、監測紀錄、定期測試報告、定期審查報告。這些會累積,但每個個別成品都小。VRF 每處理一個弱點、產出一份追蹤過、驗證過的弱點報告。RMD 每個弱點產出一份修復決策、一個開發出來的修補、一份測試報告。RLS 每個弱點產出一份安全更新 binary 加一份 CSAF 公告。PRA 每次發行產出一份簡短的回顧。

不對稱不只在「數量」,也在「持久度」。PRE 物件每季都會被讀、每次發行都會更新。RCP 到 PRA 的物件每個事件寫一次,然後歸檔。資深工程師工時投入 PRE 物件、每個週期都要付。資深工程師工時投入 RMD 物件、只有真實弱點來臨時才付。稽核員知道這件事。他們開稽核會從 PRE 開始。

§ 04原因三——準備是唯一主動的階段

用另一個鏡頭看這六個階段:哪些靠自己的時程跑、哪些靠外部事件的時程跑?

RCP、VRF、RMD、RLS、PRA 全部靠弱點的時程跑。它們是反應式階段。沒弱點來時、它們不消耗工程產能;弱點一來、它們在有限的時段內密集消耗,然後又安靜下來。一個團隊如果半年內出貨產品沒重大弱點,那段時間它幾乎不付 RCP/VRF/RMD/RLS/PRA 的成本。成本是真的,但事件驅動。

PRE 相反。PRE 靠你的發行時程跑。每次建置都重生 SBOM。每次產品線更新都重審產品識別。每季按 PRE-9 審視測試計畫。CVD 政策在人員流動時要更新。成本是連續的、無可避免、無論有沒有弱點。

這讓 PRE 成為唯一一個成本固定可預測的階段。也讓 PRE 成為唯一一個你能在外部事件之前真正「做完」的階段。RCP 到 PRA 永遠不會結束——它們在整個 support period 裡持續。PRE 有完工那一刻:你的 CI/CD 產出乾淨 SBOM 那天、你的 CVD 政策公告那天、你的安全通訊通道可用那天。從那之後,PRE 就從建構成本切換成維護成本。

這個第三個原因解釋了為什麼處理 CRA 處理得好的工程組織會把 PRE 排第一。他們先過完那波結構性投資的高峰,然後才有產能處理其他事。試圖六個階段平行做的組織、第一個真實事件來時就產能耗盡,因為 PRE 基礎設施本來該已就位來吸收它,卻沒有。

§ 05對排序的意涵

如果 40% 是下限,實作層接近三分之二、那行事曆應該反映這件事。

2026 H1。幾乎全給 PRE。SBOM 工具鏈選定、整合進 CI/CD、至少在一條產品線上驗證可用。CVD 政策起草、法務審過、公告含可用聯絡通道(security.txt 加 email alias 都活著)。產品識別架構決定。營運安全制度文件化。6 月底時、每一個 PRE-1 到 PRE-10 的可交付物你都應該能指著說「這個是真的、成品在這、維護它的流程在這」。

2026 Q3。現在你才付得起 RCP。把 CVE feed 接好。為 SBOM 列出的每個元件訂閱上游公告。第一次跑 RCP-6 的定期測試、第一次跑 RCP-7 的定期審查。用刻意設計的測試報告試煉接收機制。9 月 11 日時、通報能力是活的、是被測過的——這正是 Article 14 要的。

2026 Q4 之後。VRF、RMD、RLS、PRA 以「文件化的程序」的形式存在、不是「運作中的部門」。它們在第一個真實弱點來臨時被試煉。在那之前,原本要從零打造這些東西的工程工時、改去處理更難的附件一第一部分工作——secure-by-design、Article 13 本身的建構義務、為 2027 年 12 月準備的符合性評鑑證據夾。

排序排錯的組織通常做兩件事中的一件。要嘛按比例分配——六個階段、一年六等份——結果 Article 14 生效時六個都半成品。要嘛六個一起衝,因為每個看起來都急,結果到 2026 年中工程資深產能耗盡、什麼都沒做完。能成的形狀是尊重不對稱的:PRE 第一、RCP 第二、反應式階段最後——因為它們會被現實試煉,比被稽核員試煉還早。

紙面 40%。實作接近三分之二。照這個排程。