*<aname="_ref_i.1">[i.1]</a>Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act)
-<aname="_ref_i.1">[i.1]</a> EU 2024/2847 "Cyber Resilience Act"
*<aname="_ref_i.2">[i.2]</a> Commission Implementing Regulation (EU) TKTK TODO on the technical description of the categories of important and critical products with digital elements pursuant to Regulation (EU) 2024/2847 of the European Parliament and of the Council (Text with EEA relevance)
*<aname="_ref_i.3">[i.3]</a> CLC EN 62443-5-XX (): “Security Profile for network management systems”
*<aname="_ref_i.4">[i.4]</a> Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act)
@@ -302,6 +302,23 @@ For the purposes of the present document, abbreviations given in [TK document fr
> List uses/environments covered by other legislation or standards (critical, industrial, medical, etc.). Hoping to have a reusable generic list of these soon.
The types of product with digital elements listed in the section do not fall within the scope of the the Regulation (EU) 2024/2847 (Cyber Resilience Act), and are not covered by this standard:
1. Services, except for the remote data processing solutions for a covered product as defined in CRA recitals 11-12; article 3, 2 <aname="_ref_i.1">[i.1]</a>;
2. Products specifically designed or procured for national security and defence purpose as defined in CRA recitals 14 and 26; article 2, 7-8 <aname="_ref_i.1">[i.1]</a>;
3. Products developed for or used exclusively for internal use by public administration as defined in CRA recital 16; article 5, 2 <aname="_ref_i.1">[i.1]</a>;
4. Non-commercial free and open source software as defined in CRA recitals 17-21; article 13, 5 <aname="_ref_i.1">[i.1]</a>;
5. Medical Devices and Software as defined in CRA recital 25; article 2, 2 [a-b] <aname="_ref_i.1">[i.1]</a>;
6. Vehicles, including aviation and marine equipment as defined in CRA recital 27; article 2, 2.c "vehicles"; recital 27; article 2, 3 "aviation"; article 2, 4 "marine equipment" <aname="_ref_i.1">[i.1]</a>;
7. Spare and used parts as defined in CRA recital 29; article 2, 6 <aname="_ref_i.1">[i.1]</a>;
8. Refurbished, repaired, and upgraded products that have not been substantially modifiedas defined in recitals 39 - 42 <aname="_ref_i.1">[i.1]</a>;
The following types of products have reduced or varied requirements under Regulation (EU) 2024/2847 (Cyber Resilience Act) <aname="_ref_i.1">[i.1]</a> and can only be partially covered by this standard.
9. High Risk AI as defined in CRA recital 51; article 12 <aname="_ref_i.1">[i.1]</a>;
10. Testing and unfinished versions as defined in recital 37; Article 4, 2-3 <aname="_ref_i.1">[i.1]</a>;
11. Products Placed on the Market Prior to December 11, 2027 as defined in CRA article 69 <aname="_ref_i.1">[i.1]</a>.
## 4.3 Product overview and architecture
> Explain the overall architecture and relationship among the parts of the products. Use diagrams if that is helpful.
@@ -223,7 +223,7 @@ References are either specific (identified by date of publication and/or edition
The following referenced documents may be useful in implementing an ETSI deliverable or add to the reader's understanding but are not required for conformance to the present document.
*<aname="_ref_i.1">[i.1]</a> Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act)
*<aname="_ref_i.2">[i.2]</a> Commission Implementing Regulation (EU) TKTK TODO on the technical description of the categories of important and critical products with digital elements pursuant to Regulation (EU) 2024/2847 of the European Parliament and of the Council (Text with EEA relevance)
@@ -292,6 +292,25 @@ For the purpose of this document, a VPN is a product installed on a user device
Software, hardware, and cloud services that provide VPN capabilities as just one component of a larger or more complicated product cannot rely on this document for presumption of conformity, but may find benefit in referencing it as part of their broader conformance assessment.
The types of product with digital elements listed in the section do not fall within the scope of the the Regulation (EU) 2024/2847 (Cyber Resilience Act), and are not covered by this standard:
The types of product with digital elements listed in the section do not fall within the scope of the the Regulation (EU) 2024/2847 (Cyber Resilience Act), and are not covered by this standard:
1. Services, except for the remote data processing solutions for a covered product as defined in CRA recitals 11-12; article 3, 2 <aname="_ref_i.1">[i.1]</a>;
2. Products specifically designed or procured for national security and defence purpose as defined in CRA recitals 14 and 26; article 2, 7-8 <aname="_ref_i.1">[i.1]</a>;
3. Products developed for or used exclusively for internal use by public administration as defined in CRA recital 16; article 5, 2 <aname="_ref_i.1">[i.1]</a>;
4. Non-commercial free and open source software as defined in CRA recitals 17-21; article 13, 5 <aname="_ref_i.1">[i.1]</a>;
5. Medical Devices and Software as defined in CRA recital 25; article 2, 2 [a-b] <aname="_ref_i.1">[i.1]</a>;
6. Vehicles, including aviation and marine equipment as defined in CRA recital 27; article 2, 2.c "vehicles"; recital 27; article 2, 3 "aviation"; article 2, 4 "marine equipment" <aname="_ref_i.1">[i.1]</a>;
7. Spare and used parts as defined in CRA recital 29; article 2, 6 <aname="_ref_i.1">[i.1]</a>;
8. Refurbished, repaired, and upgraded products that have not been substantially modifiedas defined in recitals 39 - 42 <aname="_ref_i.1">[i.1]</a>;
The following types of products have reduced or varied requirements under Regulation (EU) 2024/2847 (Cyber Resilience Act) <aname="_ref_i.1">[i.1]</a> and can only be partially covered by this standard.
9. High Risk AI as defined in CRA recital 51; article 12 <aname="_ref_i.1">[i.1]</a>;
10. Testing and unfinished versions as defined in recital 37; Article 4, 2-3 <aname="_ref_i.1">[i.1]</a>;
11. Products Placed on the Market Prior to December 11, 2027 as defined in CRA article 69 <aname="_ref_i.1">[i.1]</a>.
## 4.3 Product overview and architecture
> Explain the overall architecture and relationship among the parts of the products. Use diagrams if that is helpful.
