Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
100 commits
Select commit Hold shift + click to select a range
77bf037
soi:sample: Add section Conceptual Overview
gregshue Jun 3, 2026
e55a869
soi:sample:overview: Add summary stmt
gregshue Jun 3, 2026
cd57e5d
soi:sample:overview: Add section PL Problem Domain
gregshue Jun 3, 2026
ec925f1
soi:sample:overview: Add PL Problem Domain stmt
gregshue Jun 3, 2026
40c5aaa
soi:sample:overview: Add section PL Solution Domain (Scope)
gregshue Jun 3, 2026
c5806c3
soi:sample:overview: Add diagram Generic Product Solution Framework
gregshue Jun 3, 2026
a1070ae
soi:sample:overview:soln: Add section Feature List
gregshue Jun 3, 2026
1793414
soi:sample:overview:soln: Add section Product List
gregshue Jun 3, 2026
d570220
soi:sample:overview:soln:features: Prelim Feature List
gregshue Jun 3, 2026
1088fff
soi:sample:overview:soln:products: SAMPLE Product 1
gregshue Jun 3, 2026
4a01830
soi:sample:sysreq: Add SEBoK example types of requirements
gregshue Jun 3, 2026
26ea567
soi:sample:sysreq: Add section Products
gregshue Jun 5, 2026
c60b21c
soi:sample:sysreq: Add section Form Requirements
gregshue Jun 3, 2026
7a91cec
soi:sample:sysreq: Add section Functional/Performance Requirements
gregshue Jun 3, 2026
221d7a3
soi:sample:sysreq: Add section Fit/Operational Requirements
gregshue Jun 3, 2026
3664661
soi:sample:sysreq: Add section Quality Requirements
gregshue Jun 3, 2026
ce5dd88
soi:sample:sysreq: Add section Compliance Requirements
gregshue Jun 3, 2026
1ba45aa
soi:sample:sysreq:compl: Add section EU CRA
gregshue Jun 4, 2026
d50b720
soi:sample:sysreq:compl:cra: SAMPLE conform with EU CRA
gregshue Jun 4, 2026
dea4015
soi:sample:sysreq:compl: add section EU CRA Annex I
gregshue Jun 9, 2026
1e55562
soi:sample:sysreq:compl: add section EU CRA Annex II
gregshue Jun 9, 2026
68c7e59
soi:sample:sysreq:compl: add section EU CRA Annex VII
gregshue Jun 9, 2026
e7de528
soi:sample:sysreq:compl:eu_cra:annexI: add section Part I
gregshue Jun 9, 2026
8cc8823
soi:sample:sysreq:compl:eu_cra:annexI: add section Part II
gregshue Jun 9, 2026
b45c63a
soi:sample:sysreq:compl:eu_cra:annexI:ptI: add sysreq for EU CRA Anne…
gregshue Jun 9, 2026
fa8e363
soi:sample:sysreq:compl:eu_cra:annexI:ptI: add sysreq for EU CRA Anne…
gregshue Jun 9, 2026
ae4b4f6
soi:sample:sysreq:compl:eu_cra:annexI:ptI: add sysreq for EU CRA Anne…
gregshue Jun 9, 2026
a18dbda
soi:sample:sysreq:compl:eu_cra:annexI:ptI: add sysreq for EU CRA Anne…
gregshue Jun 9, 2026
9b8ecaa
soi:sample:sysreq:compl:eu_cra:annexI:ptI: add sysreq for EU CRA Anne…
gregshue Jun 9, 2026
803d5d7
soi:sample:sysreq:compl:eu_cra:annexI:ptI: add sysreq for EU CRA Anne…
gregshue Jun 9, 2026
cf73326
soi:sample:sysreq:compl:eu_cra:annexI:ptI: add sysreq for EU CRA Anne…
gregshue Jun 9, 2026
20513b4
soi:sample:sysreq:compl:eu_cra:annexI:ptI: add sysreq for EU CRA Anne…
gregshue Jun 9, 2026
5c6482a
soi:sample:sysreq:compl:eu_cra:annexI:ptI: add sysreq for EU CRA Anne…
gregshue Jun 9, 2026
38c8e32
soi:sample:sysreq:compl:eu_cra:annexI:ptI: add sysreq for EU CRA Anne…
gregshue Jun 9, 2026
6d79a48
soi:sample:sysreq:compl:eu_cra:annexI:ptI: add sysreq for EU CRA Anne…
gregshue Jun 9, 2026
696abc4
soi:sample:sysreq:compl:eu_cra:annexI:ptI: add sysreq for EU CRA Anne…
gregshue Jun 9, 2026
950f9b7
soi:sample:sysreq:compl:eu_cra:annexI:ptI: add sysreq for EU CRA Anne…
gregshue Jun 9, 2026
89f2362
soi:sample:sysreq:compl:eu_cra:annexI:ptI: add sysreq for EU CRA Anne…
gregshue Jun 9, 2026
fdf6704
soi:sample:sysreq:compl:eu_cra:annexI:ptII: add sysreq for EU CRA Ann…
gregshue Jun 9, 2026
56ee161
soi:sample:sysreq:compl:eu_cra:annexI:ptII: add sysreq for EU CRA Ann…
gregshue Jun 9, 2026
1f8c230
soi:sample:sysreq:compl:eu_cra:annexI:ptII: add sysreq for EU CRA Ann…
gregshue Jun 9, 2026
33d74b9
soi:sample:sysreq:compl:eu_cra:annexI:ptII: add sysreq for EU CRA Ann…
gregshue Jun 9, 2026
f0655e2
soi:sample:sysreq:compl:eu_cra:annexI:ptII: add sysreq for EU CRA Ann…
gregshue Jun 9, 2026
7effb93
soi:sample:sysreq:compl:eu_cra:annexI:ptII: add sysreq for EU CRA Ann…
gregshue Jun 9, 2026
3d9ac8e
soi:sample:sysreq:compl:eu_cra:annexI:ptII: add sysreq for EU CRA Ann…
gregshue Jun 9, 2026
e9ab535
soi:sample:sysreq:compl:eu_cra:annexI:ptII: add sysreq for EU CRA Ann…
gregshue Jun 9, 2026
ac45c4f
soi:sample:sysreq:compl:eu_cra:annexI:ptII: add sysreq for EU CRA Ann…
gregshue Jun 9, 2026
0f6519f
soi:sample:sysreq:compl:eu_cra:annexI:ptII: add sysreq for EU CRA Ann…
gregshue Jun 9, 2026
f608d5a
soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex I…
gregshue Jun 9, 2026
af43944
soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex I…
gregshue Jun 9, 2026
c8d5440
soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex I…
gregshue Jun 9, 2026
a4a4174
soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex I…
gregshue Jun 9, 2026
48b9472
soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex I…
gregshue Jun 9, 2026
c69c550
soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex I…
gregshue Jun 9, 2026
d388386
soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex I…
gregshue Jun 9, 2026
3642e35
soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex I…
gregshue Jun 9, 2026
4b1a97e
soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex I…
gregshue Jun 9, 2026
5310966
soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex I…
gregshue Jun 9, 2026
c0259f8
soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex I…
gregshue Jun 9, 2026
4c29ca6
soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex I…
gregshue Jun 9, 2026
c650cb7
soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex I…
gregshue Jun 9, 2026
800e5d3
soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex I…
gregshue Jun 9, 2026
0c82500
soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex I…
gregshue Jun 9, 2026
36ad558
soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex I…
gregshue Jun 9, 2026
97e816c
soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex I…
gregshue Jun 9, 2026
e442a1a
soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex I…
gregshue Jun 9, 2026
2b71cf6
soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex I…
gregshue Jun 9, 2026
1cec0d2
soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex I…
gregshue Jun 9, 2026
30e863a
soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex V…
gregshue Jun 9, 2026
f196c71
soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex V…
gregshue Jun 9, 2026
7529cc7
soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex V…
gregshue Jun 9, 2026
7f26944
soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex V…
gregshue Jun 9, 2026
e69197f
soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex V…
gregshue Jun 9, 2026
9c65117
soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex V…
gregshue Jun 9, 2026
4c4bfdc
soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex V…
gregshue Jun 9, 2026
913a337
soi:sample:sysreq:compl:eu_cra:annexII: add sysreq for EU CRA Annex V…
gregshue Jun 9, 2026
7ff42e4
soi:sample:sysreq:prd: Add section Network Interfaces
gregshue Jun 5, 2026
3e9854b
soi:sample:sysreq:prd:netIfc: Add section SAMPLE Product 1
gregshue Jun 3, 2026
59c453f
soi:sample:sysreq:prd:netIfc:prd1: prelim feature list
gregshue Jun 4, 2026
41d03fc
soi:sample:sysreq:prd:netIfc:prd1: prelim market name
gregshue Jun 4, 2026
5f0102e
soi:sample:sysreq:prd:netIfc:prd1: Use SAMPLE USB Dongle Dimension Li…
gregshue Jun 4, 2026
2f2d5f6
soi:sample:sysreq:prd:netIfc:prd1: Uses SAMPLE Comm Env Limits
gregshue Jun 4, 2026
24783e1
soi:sample:sysreq:form: Add section Network Interfaces
gregshue Jun 5, 2026
7150bc6
soi:sample:sysreq:form:netIfc: add section USB Network Interface Dongles
gregshue Jun 5, 2026
87e9517
soi:sample:sysreq:form:netIfc:UsbNetIfcDongle: add req USB Network In…
gregshue Jun 5, 2026
70140ef
soi:sample:sysreq:fitOp: Add req for SAMPLE Commercial Office Env Limits
gregshue Jun 5, 2026
4606656
soi:sample:sysreq:conf:eu_cra clean out `with digital elements`
gregshue Jun 12, 2026
f0fe721
soi:sample:sysreq:conf:eu_cra expand to `expose to market(s)`
gregshue Jun 12, 2026
318964a
Update conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc
gregshue Jun 13, 2026
ce61e22
Update conformance/example1/content/src/SOI/SAMPLE/system_requirement…
gregshue Jun 13, 2026
d14ade9
Update conformance/example1/content/src/SOI/SAMPLE/system_requirement…
gregshue Jun 13, 2026
9ea2643
Update conformance/example1/content/src/SOI/SAMPLE/system_requirement…
gregshue Jun 13, 2026
56eec7e
Update index.sdoc
gregshue Jun 14, 2026
4dda8df
Update index.sdoc
gregshue Jun 14, 2026
a9c267f
Update conformance/example1/content/src/SOI/SAMPLE/system_requirement…
gregshue Jun 15, 2026
ff1cc1a
Update conformance/example1/content/src/SOI/SAMPLE/system_requirement…
gregshue Jun 15, 2026
20c021c
fix strictdoc_config statistics generation
gregshue Jun 15, 2026
b9467c4
soi:sample:sysreq:prd:netIfc:prd1 fix nested bullets formatting
gregshue Jun 19, 2026
8b8485b
soi:sample: define commodity device
gregshue Jun 26, 2026
cd74750
note describing sdoc item use for normative vs informative content
gregshue Jun 26, 2026
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
164 changes: 153 additions & 11 deletions conformance/example1/content/src/SOI/SAMPLE/sdoc/index.sdoc
Original file line number Diff line number Diff line change
Expand Up @@ -8,30 +8,172 @@ SPDX-License-Identifier: Apache-2.0

[TEXT]
STATEMENT: >>>
The System-of-Interest named SAMPLE is the top-level system in this example.
The System-of-Interest named SAMPLE is the top-level system in this example.
<<<

[[SECTION]]
TITLE: Conceptual Overview

[TEXT]
STATEMENT: >>>
SAMPLE is a Product Line of commodity consumer electronics devices intended for
markets requiring conformance with the EU Cyber Resilience Act. The range of
devices supported by this Product Line is expected to expand over time as
more product types become commoditized.
Comment on lines +19 to +22

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are you talking about a reusable component intended for inclusion in an OEM product for sale direct to consumers? I think the use of the word commoditized is also a little confusing. I can think of a number of reusable components that are branded (not commoditized), but otherwise purport to fulfill an industry specification that may or may not be implemented by others.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am talking about the end products-with-digital-elements being commodity devices. This is informative content rather than normative, so it doesn't have to be proved or verified. Perhaps we need a title/section to make that distinct.

Your question prompted me to look for a definition of "commodity devices". From SUSE.com I found the following:

Commodity hardware, sometimes known as off-the-shelf hardware, is a computer device or IT component that is relatively inexpensive, widely available and basically interchangeable with other hardware of its type. Unlike purpose-built hardware designed for a specific IT function, commodity hardware can perform many different functions. Commodity hardware is usually low-end, broadly compatible and can function on a plug-and-play basis with other commodity hardware products. ...

Generally, commodity hardware can evolve from any technologically mature product. Thus, most hardware products that have been on the market for five years or more are available in commodity versions. ...

USB devices (e.g., Thumb drives) are always branded and each has a serial number. The lowest-cost versions that are functionally identical and provide only standard USB interfaces that pull in common drivers provided by the OS vendor are essentially commodity devices. The business profit model is competing on low price, lower cost, and high volume. I have used the term "commodity devices" to refer to this end of the spectrum.

Please note that some of the electrical components within the commodity devices will also be commodity electronics (e..g, resistors, USB connectors, NAND flash chips), where others will not be (e.g., SOC holding non-standard register interfaces to digital logic blocks).


For this Product Line, "commodity devices" matches this definition from
`SUSE.com <https://www.suse.com/topics/definition/commodity-hardware>`__:

Commodity hardware, sometimes known as off-the-shelf hardware,
is a computer device or IT component that is relatively inexpensive,
widely available and basically interchangeable with other hardware of its type.
Unlike purpose-built hardware designed for a specific IT function,
commodity hardware can perform many different functions.
Commodity hardware is usually low-end, broadly compatible and
can function on a plug-and-play basis with other commodity hardware products. ...

Generally, commodity hardware can evolve from any technologically mature product.
Thus, most hardware products that have been on the market for five years or more
are available in commodity versions. ...

SAMPLE is expected to be **reused and extended** by
interested Open-Source Software Projects and Component Manufacturers for
developing assets conformant with the EU CRA.
<<<

[[SECTION]]
TITLE: Product Line Problem Domain

[TEXT]
STATEMENT: >>>
SAMPLE is intended to support at least
commodity consumer electronics devices. These products may end
up being used in commercial and/or civil deployments.
These products are NOT expected to be used in industrial or
safety-critical deployments.
Comment on lines +52 to +53

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Short response: "NOT expected" is a negative requirement, or "negative intent" if you prefer. Neither can be proven. It is probably also true that the product is not expected to be used in an infinite number of ways well beyond industrial and safety-critical deployments. Sticking to what IS intended keeps the burden of proof finite.

Longer response: While I am certain it would not be difficult to find plenty of examples of manufacturers who specifically intend for their component to be used in industrial or safety-critical deployments, I am not sure that kind of intent is the norm. In my experience an OEM chooses a component for its fitness regardless of what the manufacturer intended of it. At that point, the OEM takes responsibility for the outcome. At the highest levels of criticality, component heritage is defined as the operational track record. The component manufacturer is neither responsible for, nor likely aware of, the operational track record of their products they sell to OEMs (failures notwithstanding).

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is informative content rather than normative, so it doesn't have to be proved or verified. Perhaps we need a title/section to make that distinct.

The EU CRA Annex II item requires the User Documentation to describe "the intended use, including the security environment provided by the manufacturer, as well as the product’s essential functionalities and information about the security properties;"

Yes, there are many hardware components that are specifically intended for safety-critical environments (e.g., automotive grade SOCs vs non-automotive grade). I have also run across similar distinctions for RTOS usages (e.g., Green Hills Software product INTEGRITY-178 tuMP Safety-Critical & Security-Critical RTOS vs. Green Hills Software product INTEGRITY RTOS).


To support growth of the Product Line Solution Domain (solution space)
with minimal impact on existing assets, the Product Line Problem Domain
will be the context for evaluating and understanding all System Engineering
artifacts for SAMPLE.
<<<

[[/SECTION]]

It is expected to be composed of the following subsystems:
[[SECTION]]
TITLE: Product Line Solution Domain (Scope)

[TEXT]
STATEMENT: >>>
SAMPLE is designed upon the following generic solution framework for products:

.. raw:: html

<pre class="mermaid">
---
title: Topology of Systems-of-Interest
title: Generic Product Solution Framework
---
stateDiagram-v2
state "Cloud-based Services" as MfgCloudSvcs {
direction LR
state "Product Support" as PrdSupport {
direction LR
state "Documentation <br/>(per Product)" as PrdDocs
}
}

state SAMPLE {
TBD_Security_Vulnerability_Reporting: TBD <br/> Security <br/> Vulnerability <br/> Reporting <br/> Server
TBD_Desktop_SW: TBD <br/> Desktop SW
TBD_Mobile_SW: TBD <br/> Mobile SW
TBD_Devices: TBD <br/> Device(s)
TBD_Cloud_SW: TBD <br/> Cloud SW
TBD_Digital_Component_Update_Server: TBD <br/> Digital <br/> Component <br/> Update <br/> Server
}
state "Applications" as MgrApps {
direction LR
state "Desktop Applications" as MfgDesktopApps
state "Mobile Apps" as MfgMobileApps
}

state "Devices" as Devices {
direction LR
state "Manufacturer Parts" as MfgParts
}
</pre>
<<<

[[SECTION]]
TITLE: Feature List

[TEXT]
STATEMENT: >>>
As a Product Line evolves the sponsors of the Product Line may require it
to support a larger solution domain than previously chosen. A best practice
for Product Line Engineering is to evaluate architectures and designs for
reusability in reasonably foreseeable scope growth.

The following Feature List outlines the breadth of product categories
and functionalities to be considered when describing and evaluating
SAMPLE requirements and designs.

.. note::
Bold text indicates **invariant feature/value** across Product Line scope.

Italic text indicates *anticipated expansion* of Product Line scope.

- User Interface

- Label(s)
- Device Status LED(s)
- Button(s)
- *Network Activity Indication(s)*
- *User Authentication via Finger Print*

- Communication Interfaces

- USB Device

- Physical Connector

- *USB A Male*
- USB C Male connector

- Network Interface

- 100BASE-TX
- *10BASE-T1L*
- *802.15.4*
- *BlueTooth*
- *WIFI*

- Functionality

- Secure Boot
- Firmware Update

- On-demand FW Update (pushed to Device)
- *Automated FW Update (pulled by Device)*
- *FW Update schedule control <br/>(periods of blocked vs listening vs requesting)*

- Network Interface
- *Network Sniffer*
- *Network Router*
- *Network Gateway*
- *Network-Attached Storage (NAS)*
- *BlueTooth Beacon*
<<<

[[/SECTION]]

[[SECTION]]
TITLE: Product List

[TEXT]
STATEMENT: >>>
The following are nominal descriptions of the products in SAMPLE:

- SAMPLE Product 1: a USB-C to 100Base-T Network Interface Dongle
<<<

[[/SECTION]]

[[/SECTION]]

[[/SECTION]]

[DOCUMENT_FROM_FILE]
FILE: ../system_requirements/sdoc/index.sdoc

Expand Down
Loading
Loading