Reference. 參考文獻。
The reading list behind this notebook. The text I read, the platforms I rely on, the documents I keep checking back against. 這個筆記本背後的閱讀清單。我讀的條文、我仰賴的平台、我會反覆回去翻的文件。
On revisions to this page. Reference entries are revised silently as URLs, versions, and metadata change. The errata page logs only corrections to commentary about CRA content — not maintenance of the bibliography itself. 關於本頁修訂。當 URL、版本、metadata 變動時、reference entry 會直接更新、不另記。勘誤頁 只記錄 CRA 內容相關評論的修訂、不收本書目的維護紀錄。
EU regulations — binding text歐盟法規 — 具強制適用力
These are the documents whose text the site cites verbatim. Every binding claim on this site traces to one of these. 本站字面引用的條文都來自這幾份。所有具強制適用力的論述都追溯到這些文件。
Cyber Resilience Act and supplementsCRA 與其補充法規
Regulation (EU) 2024/2847 — Cyber Resilience Act法規 (EU) 2024/2847 — 網路韌性法
The base regulation. Defines the scope, manufacturer obligations, conformity assessment routes, market surveillance, and reporting framework. Fully applicable from 11 December 2027; Article 14 reporting from 11 September 2026. 基礎法規。界定適用範圍、製造商義務、符合性評鑑路徑、市場監督、通報框架。2027 年 12 月 11 日全面適用；第 14 條通報義務於 2026 年 9 月 11 日啟動。
Commission Delegated Regulation (EU) 2026/881 — supplementing CRA Article 14(9) on grounds for delaying SRP dissemination執委會授權法規 (EU) 2026/881 — 補充 CRA 第 14(9) 條、SRP 散播延遲的理由
Specifies the grounds on which CSIRTs and ENISA may delay disseminating vulnerability notifications submitted via the Single Reporting Platform. Three categories of conditions: nature of information (Art 3, four sub-conditions), CSIRT confidentiality (Art 4), SRP outage (Art 5). 規定 CSIRT 與 ENISA 得延遲散播 SRP 提交弱點通報的理由。三類條件：資訊性質（第 3 條、四個子條件）、CSIRT 機密性（第 4 條）、SRP 停機（第 5 條）。
Commission Implementing Regulation (EU) 2025/2392 — technical descriptions of important and critical product categories執委會執行法規 (EU) 2025/2392 — 重要與關鍵產品類別的技術描述
Pursuant to Article 7(4) CRA. Provides binding technical descriptions for the 28 product categories listed in Annex III (Important Class I + II) and Annex IV (Critical) of the CRA. Resolves the classification ambiguity manufacturers previously faced when reading the Annexes' general descriptions. First major piece of CRA secondary legislation. Recitals 3–5 govern when an embedded component does or does not pull the host product into the category — the boundary rule the site's Article 7 commentary depends on. 依 CRA 第 7(4) 條授權。對 CRA 附件三（Important Class I + II）與附件四（Critical）所列 28 個產品類別、提供具強制適用力的技術描述。解決製造商先前依附件原文一般性描述判斷類別的歧義。CRA 首部重要 secondary legislation。Recital 3–5 規定嵌入式元件何時會使母產品落入該類別、是本站第 7 條 commentary 倚賴的邊界規則。
Closely related EU regulations相關歐盟法規
Directive (EU) 2022/2555 — NIS2指令 (EU) 2022/2555 — NIS2
CSIRT designation regime that the CRA reporting cascade rests on. CRA Article 14(7) routes notifications via the CSIRT designated as coordinator under NIS2. The Cooperation Group established under NIS2 Article 14 is referenced in CRA Article 13(25). CRA 通報層級依靠的 CSIRT 指定機制。CRA 第 14(7) 條的通報是透過 NIS2 指定的協調 CSIRT。NIS2 第 14 條設立的 Cooperation Group 在 CRA 第 13(25) 條被引用。
Regulation (EU) 2024/1689 — AI Act法規 (EU) 2024/1689 — AI 法
Cross-applicability for products with digital elements that are also AI systems. CRA Annex III Class II overlaps with AI Act Annex VI/VII conformity assessment in some cases; routing decisions need both regulations read together. 與「具數位元素產品」同時為 AI 系統時的交叉適用。CRA 附件三 Class II 在某些情況與 AI 法附件六 / 七的符合性評鑑路徑重疊；路徑判斷需兩部法規並讀。
Regulation (EU) 2016/679 — GDPR法規 (EU) 2016/679 — GDPR
Personal-data overlap and breach-notification interplay. CRA Article 14 incident reporting and GDPR Article 33 breach notification can be triggered by the same event, with different regulators, different deadlines, and different content requirements. 個資領域的重疊、與洩漏通報的互動。CRA 第 14 條事件通報與 GDPR 第 33 條洩漏通報可能由同一事件觸發、向不同主管機關、不同期限、不同內容要求。
Regulation (EU) 2023/1230 — Machinery Regulation法規 (EU) 2023/1230 — 機械法規
CRA Recital 53 cross-compliance for products that are both machinery and products with digital elements. Cybersecurity essential requirements under CRA may help demonstrate compliance with machinery essential requirements that also cover cybersecurity risks (Annex III sections 1.1.9, 1.2.1). CRA 序言 (53) 對「同為機械、又屬具數位元素產品」的交叉合規。CRA 的網路安全 essential requirements 可能協助證明符合機械法規亦涵蓋網路安全風險的 essential requirements（附件三 1.1.9、1.2.1）。
Directive 2014/53/EU — Radio Equipment Directive (RED) and Delegated Act (RED-DA) (EU) 2022/30指令 2014/53/EU — 無線電設備指令（RED）與授權法案 (EU) 2022/30
RED-DA covers cybersecurity essential requirements for radio products. The CRA progressively supersedes RED-DA for non-radio cybersecurity aspects; transition handling matters for products on the market under RED-DA before CRA full application. RED-DA 涵蓋無線產品的網路安全 essential requirements。CRA 對無線設備以外的網路安全層面逐步取代 RED-DA；CRA 全面適用前已依 RED-DA 投入市場的產品、過渡處理重要。
Commission Implementing Regulation (EU) 2024/482 — EUCC scheme執委會執行法規 (EU) 2024/482 — EUCC 方案
EU Common Criteria-based cybersecurity certification scheme. CRA Annex IV Critical-class products may be required to use EUCC at the “substantial” assurance level once delegated acts under CRA Article 8 are adopted. EU 以 Common Criteria 為基礎的網路安全認證方案。CRA 附件四關鍵類產品在 CRA 第 8 條的授權法案通過後、可能被要求使用 EUCC「substantial」保證等級。
European Commission documents — non-binding執委會文件 — 無強制適用力
Authoritative but not legally binding. Useful for clarifying scope and intent; do not displace the regulation text. 具權威性、但無法律強制力。對釐清適用範圍與立法意圖有用；不取代條文本身。
FAQs on the Cyber Resilience Act, v1.2CRA FAQs v1.2
Living document. Commission states explicitly that the FAQs are not authoritative and do not extend rights or obligations. Useful for surfacing how the Commission services currently read recurring questions on scope, definitions, transitions. 活文件。執委會明確聲明此 FAQ 非權威性、不擴張權利或義務。對了解執委會幕僚目前如何理解範圍、定義、過渡相關常見問題、有用。
Draft Commission Guidance on the application of the CRA — Communication Ares(2026)2319816執委會 CRA 適用指引草案 — Communication Ares(2026)2319816
First Commission guidance issued under Article 26 CRA. Approximately 70 pages, 232 paragraphs, structured around 9 thematic areas: scope/applicability (incl. RDPS three-part test, source-code/data-connection edge cases), FOSS placed-on-market boundary, support periods, substantial modification (4-factor test, 17 worked examples), CRA-vs-other-EU-law interplay, reporting obligations, microenterprise/SME considerations. Heavily relied on for the site's Guidance section, which marks each interpretation as draft. Non-binding; final-version differences possible after stakeholder feedback review. 執委會依 CRA 第 26 條發布的首份指引。約 70 頁、232 paragraphs、涵蓋 9 個主題：scope/applicability（含 RDPS 三部分測試、source-code/data-connection 邊界 case）、FOSS placed-on-market 邊界、support periods、substantial modification（4-factor test、17 個 worked example）、CRA 與其他 EU 法規 interplay、reporting obligations、microenterprise/SME 考量。本站 解讀 區塊大量倚賴此文件、每項解讀都標明為草案。非強制適用；待 stakeholder feedback 審查後、最終版可能與草案有出入。
EC announcement (DG CNECT) · Have Your Say (consultation portal)
Standardisation Request M/606 — harmonised standards in support of the CRA標準化要求 M/606 — 支持 CRA 的調和標準
The Commission's request to CEN, CENELEC, and ETSI for 41 harmonised standards (15 horizontal + 26 vertical) giving conformity presumption to CRA Annex I. Underpins the prEN 40000-1-x series. Vertical standards target Annex III Class I/II and Annex IV products with EN 304 6xx numbering scheme. 執委會要求 CEN、CENELEC、ETSI 制定 41 份能對 CRA 附件一賦予 conformity presumption 的調和標準（15 份 horizontal + 26 份 vertical）。是 prEN 40000-1-x 系列的依據。Vertical 標準針對附件三 Class I/II 與附件四產品、採用 EN 304 6xx 編號規則。
Harmonised standards and technical specifications調和標準與技術規範
Draft European standards that, once adopted and cited in the OJ, give CRA Annex I conformity presumption. As of Last verified, all of the prEN 40000-1-x series remain in draft. 當被採用並於 OJ 引用後、能對 CRA 附件一賦予 conformity presumption 的歐洲標準草案。截至 Last verified 日期、prEN 40000-1-x 系列全數仍為草案。
prEN 40000-1-1:2025 — Cybersecurity for products with digital elements: framework and vocabularyprEN 40000-1-1:2025 — 具數位元素產品之網路安全：框架與術語
Part 1 of the harmonised standard series. Provides the vocabulary and the framework that the other parts build on. Currently in draft; not yet OJ-cited. 調和標準系列第一部分。提供其他部分立基的術語與框架。目前為草案、尚未於 OJ 引用。
prEN 40000-1-2:2025 — Cybersecurity for products with digital elements: generic security requirementsprEN 40000-1-2:2025 — 具數位元素產品之網路安全：通用安全要求
Part 2 of the series. Generic security requirements mappable to CRA Annex I Part I (the 13 product-property essential requirements). Currently in draft. 系列第二部分。可對應到 CRA 附件一第一部分（13 個產品性質 essential requirements）的通用安全要求。目前為草案。
prEN 40000-1-3:2025 — Cybersecurity for products with digital elements: vulnerability handlingprEN 40000-1-3:2025 — 具數位元素產品之網路安全：弱點處理
Part 3 of the series. Vulnerability handling, mappable to CRA Annex I Part II. Decomposes vulnerability handling into 6 phases (PRE, RECEIVE, TRIAGE, REMEDIATE, COMMUNICATE, LEARN), 25 requirement groups. The site's commentary on the PRE phase relies on this draft. 系列第三部分。對應到 CRA 附件一第二部分的弱點處理。將弱點處理拆為 6 個階段（PRE、RECEIVE、TRIAGE、REMEDIATE、COMMUNICATE、LEARN）、共 25 個 requirement group。本站關於 PRE 階段的 commentary 依靠此草案。
EN 18031 series (parts 1, 2, 3) — Common security requirements for radio equipmentEN 18031 系列（第 1、2、3 部分）— 無線電設備共通安全要求
Adopted harmonised standard for RED-DA Article 3(3)(d–f) cybersecurity requirements. Mappable to CRA Annex I; manufacturers compliant with EN 18031 today have a head start on CRA conformity, with caveats on what is and is not covered. RED-DA 第 3(3)(d–f) 條網路安全要求的已採用調和標準。可對應 CRA 附件一；目前符合 EN 18031 的製造商在 CRA 合規上有先行優勢、但涵蓋與不涵蓋的範圍須留意。
EN IEC 62443-4-1 — Industrial communication networks: security for IACS, product development requirementsEN IEC 62443-4-1 — 工業通訊網路：IACS 安全、產品開發要求
Industrial automation and control systems product-development security baseline. Cited by industrial-product manufacturers as the supply-chain due-diligence reference for CRA Article 13(5)/(6). Not a CRA harmonised standard, but widely adopted in OT contexts. 工業自動化與控制系統產品開發安全基準。被工業產品製造商作為 CRA 第 13(5)/(6) 條供應鏈盡職調查的參考依據。不是 CRA 的調和標準、但 OT 領域廣泛採用。
ENISAENISA
European Union Agency for Cybersecurity. Operates the Single Reporting Platform under CRA Article 16 and publishes periodic reports. 歐盟網路安全局。依 CRA 第 16 條營運 Single Reporting Platform、並定期發布報告。
ENISA Single Reporting Platform (SRP)ENISA Single Reporting Platform（SRP）
Single entry point for Article 14 reporting (vulnerabilities and severe incidents). Manufacturers will file via electronic notification end-points routed to the CSIRT designated as coordinator. Implementation tendered under ENISA/2025/OP/0001 (4-year contract, closed Mar 2025); vendor not publicly disclosed. No registration mechanism or URL has been published as of April 2026; testing period expected before 11 Sep 2026 operational date. 第 14 條通報（弱點與嚴重事件）的單一入口。製造商將透過電子通報端點提交、路由到指定協調 CSIRT。實作以 ENISA/2025/OP/0001 招標（4 年合約、2025 年 3 月截止），廠商未公開揭露。截至 2026 年 4 月、尚未公布註冊機制或 URL；2026-09-11 上線日前預計有測試期。
ENISA Threat Landscape (ETL) — annual reportENISA Threat Landscape（ETL）— 年度報告
Sector-by-sector threat trend report. Informational input for risk assessment baselines under CRA Article 13(2)/(3). Not a regulatory document, but useful for grounding the risk-assessment narrative against documented threat patterns. 分領域威脅趨勢報告。CRA 第 13(2)/(3) 條風險評估基準的資訊輸入。非法規文件、但對將風險評估敘述對齊已有記錄的威脅模式、有用。
Member-state documents會員國文件
National-level guidance and standards bodies. Informational for cross-EU readers; can be authoritative within their issuing jurisdiction. 國家層級指引與標準機構。對跨歐盟讀者是資訊性參考；在發布國管轄範圍內可能具權威。
BSI Technical Report 03183 (TR-03183) — parts 1, 2, 3, HBSI Technical Report 03183（TR-03183）— 第 1、2、3、H 部分
German national guidance on cybersecurity for products with digital elements. TR-03183 has four parts: Part 1 (general requirements), Part 2 (SBOM), Part 3 (vulnerability reports and notifications), Part H (CRA conformity via ISO/IEC 27001 ISMS / Module H). Mappable to CRA Article 13. Treated as informational outside Germany. 德國關於具數位元素產品的網路安全國家指引。TR-03183 有四個部分：Part 1（通用要求）、Part 2（SBOM）、Part 3（弱點通報）、Part H（透過 ISO/IEC 27001 ISMS / Module H 證明 CRA 符合性）。可對應 CRA 第 13 條。在德國以外屬資訊性參考。
NEN-EN 40000-1-x:2025 Ontwerp (Dutch national publication of European drafts)NEN-EN 40000-1-x:2025 草案（歐洲標準草案的荷蘭國家版本）
Dutch national publication of the prEN 40000-1-x drafts for national-level commentary. Content is identical (IDT) to the prEN drafts. Useful when the prEN PDFs are difficult to access; NEN drafts are a parallel route to the same text. prEN 40000-1-x 草案的荷蘭國家層級公布、供國內意見徵集。內容與 prEN 草案相同（IDT）。當 prEN PDF 難以取得時、NEN 草案是同一文本的平行管道。
Cross-reference and industry frameworks交叉參考與業界框架
Frameworks and formats not specific to the CRA, but referenced by manufacturers when designing CRA compliance programmes. 非 CRA 專屬、但製造商設計 CRA 合規計畫時會參照的框架與格式。
NIST Cybersecurity Framework 2.0; NIST SP 800-53NIST 網路安全框架 2.0；NIST SP 800-53
US framework. Some manufacturers cross-walk NIST CSF / SP 800-53 controls to CRA essential requirements as a way to leverage existing programmes. Not a CRA conformity route. 美國框架。部分製造商將 NIST CSF / SP 800-53 控制項對應 CRA essential requirements、藉此沿用既有計畫。非 CRA 合規路徑。
ISO/IEC 27001:2022 — Information security management systemsISO/IEC 27001:2022 — 資訊安全管理系統
Management system reference. Informational; ISO 27001 certification is not a CRA conformity route. Manufacturers with mature ISMS programmes already satisfy parts of Annex I Part II vulnerability handling, but the CRA scope is broader. Note: BSI TR-03183-H provides a path to demonstrate CRA conformity through an ISO 27001-compliant ISMS. 管理系統參考。資訊性、ISO 27001 認證非 CRA 合規路徑。已有成熟 ISMS 計畫的製造商已滿足附件一第二部分弱點處理的部分內容、但 CRA 範圍更廣。註：BSI TR-03183-H 提供透過 ISO 27001 相容 ISMS 證明 CRA 符合性的路徑。
CSAF (Common Security Advisory Framework) 2.0CSAF（Common Security Advisory Framework）2.0
Machine-readable format for security advisories. Relevant to Article 14 reporting workflow design. Some Commission documents suggest CSAF will be among the formats specified by implementing acts under Article 13(24). 安全公告的機器可讀格式。與第 14 條通報工作流程設計相關。部分執委會文件暗示 CSAF 會是第 13(24) 條執行法案規定的格式之一。
SBOM formats: SPDX 3.0, CycloneDX 1.6SBOM 格式：SPDX 3.0、CycloneDX 1.6
SBOM formats potentially specified by Commission implementing acts under CRA Article 13(24). Both formats are operational standards in industry; no Commission act has yet bound either as the CRA-specified format. CRA 第 13(24) 條執行法案可能指定的 SBOM 格式。兩者皆為業界營運層級標準；尚無執委會法案將任一指定為 CRA 標準格式。
How this list is maintained這份清單如何維護
Each entry carries a Last verified date — the day I last confirmed the document is the active version, the URL still resolves, and the version number (where applicable) has not moved. When something changes (a new prEN draft, a Commission FAQ version bump, an OJ corrigendum), the entry's annotation and date are updated. 每筆 entry 帶 Last verified 日期 — 我最後一次確認該文件是現行版本、URL 仍能解析、版本號（如有）尚未變動的日子。內容有變動時（新的 prEN 草案、執委會 FAQ 升版、OJ corrigendum）、entry 的 annotation 與日期會更新。
This page is a living working bibliography, not a snapshot. Suggestions for additions, especially for documents I should be tracking but am not, are welcome. 這頁是工作中的活書目、不是快照。歡迎建議該追蹤但目前未列的文件。