AuCRA SHIELD

prEN 40000-1-3:2025 · Clause 5

Work the case. The audit pack writes itself.

Every requirement of the standard is data. Each one counts as satisfied only when a real artifact is linked to it, never because somebody ticked a box.

Create a workspace Log in Contact Auray

ONE CASE, START TO PACK edge-router-x1

CASE-0042 CVE-2026-1234 · edge-router-x1 · CVSS 8.1 reported 2026-10-16 · external researcher Received Triaged Remediated Published RCP VRF RMD RLS 4 of 7 phases shown · 34 of 79 requirements · one ID space AUDIT PACK edge-router-x1 · Q4 2026 EVIDENCE INDEX cvd-report-0042.eml sha256 3f9a…c1e2 sbom-match.json sha256 b71c…77a0 risk-assessment.pdf sha256 e04d…51f9 release-2.4.1.json sha256 9c2e…0d4b linked evidence sealed · sha256 verified RCP-1-RQ-01 · cvd-report-0042.eml RCP-3-RQ-01 · sbom-match.json VRF-2-RQ-01 · risk-assessment.pdf RLS-1-RQ-01 · release-2.4.1.json

prEN 40000-1-3:2025 · Clause 5

79 requirements. Watch them turn green as the work is done.

The standard is encoded as one ID space. Each cell turns green only when a real artifact is linked to it.

Create a workspace Log in Contact Auray

APP APP-1-RQ-01
PRE PRE-1-RQ-01 PRE-1-RC-01 PRE-1-RQ-02 PRE-1-RC-02 PRE-1-RQ-03 PRE-1-RQ-04 PRE-1-RQ-05 PRE-2-RQ-01 PRE-2-RQ-02 PRE-2-RC-01 PRE-2-RQ-03 PRE-2-RC-02 PRE-2-RC-03 PRE-3-RC-01 PRE-3-RQ-01 PRE-4-RQ-01 PRE-4-RQ-02 PRE-5-RC-01 PRE-5-RQ-01-RE PRE-5-RC-02 PRE-5-RC-03 PRE-5-RC-04 PRE-6-RQ-01 PRE-6-RQ-02 PRE-7-RQ-01 PRE-7-RQ-02 PRE-7-RQ-03 PRE-7-RQ-03-RE PRE-7-RQ-04 PRE-7-RQ-05 PRE-7-RC-01 PRE-7-RQ-06 PRE-7-RQ-07 PRE-7-RQ-07-RE PRE-8-RQ-01 PRE-8-RQ-02 PRE-9-RQ-01 PRE-9-RQ-02 PRE-9-RQ-03 PRE-9-RQ-04 PRE-10-RQ-01 PRE-10-RQ-02 PRE-10-RQ-03
RCP RCP-1-RQ-01 RCP-1-RQ-02 RCP-1-RQ-03 RCP-1-RC-01 RCP-2-RQ-01 RCP-2-RQ-02 RCP-2-RQ-04 RCP-3-RQ-01 RCP-4-RQ-01 RCP-5-RC-01 RCP-6-RQ-01 RCP-7-RQ-01 RCP-7-RQ-02
VRF VRF-1-RQ-01 VRF-1-RQ-02 VRF-2-RQ-01 VRF-2-RQ-02 VRF-2-RQ-03 VRF-2-RQ-04
RMD RMD-1-RQ-01 RMD-1-RQ-02 RMD-2-RQ-01 RMD-2-RQ-02 RMD-3-RQ-01
RLS RLS-1-RQ-01 RLS-1-RQ-02 RLS-1-RQ-03 RLS-1-RQ-04 RLS-2-RQ-01 RLS-2-RQ-02 RLS-2-RQ-03 RLS-2-RQ-03-RE RLS-2-PM-01 RLS-2-RC-01
PRA PRA-1-RQ-01

sample product · 13 of 79 linked so far 50 mandatory · 14 recommended · 10 conditional · 4 risk-gated · 1 permitted

How a case becomes evidence

Handling the case is the paperwork.

Each guarded step links its own evidence to the requirements it satisfies. Hover a step to replay it.

  1. public CVD form CASE-0043 acknowledged · triage due

    01RCP · Receipt

    A report arrives.

    The public CVD form opens a case; the report is its first piece of evidence.

  2. SBOM busybox 1.36 libssl 3.0.1 u-boot 2024.01 affected

    02RCP · Receipt

    Matched against the SBOM.

    The affected component is found in the product's own inventory, not guessed.

  3. Release fix RCP-3-RQ-01 missing sbom-match.json linked the guard names the requirement

    03RMD · Remediation

    A guard says no, then yes.

    A blocked step names the requirement it is waiting on. Link the artifact and it opens.

  4. report.html evidence_index.csv policy-v1.2.pdf sha256 3f9a…c1e2

    04RLS · Release

    The pack seals itself.

    Report, index and files share one SHA-256. It opens offline and prints to A4.

The standard, encoded

79 items. 7 phases. One ID space.

The only authority for requirement IDs in the platform, versioned as data. Register a product and every cell below is instantiated against it, with an owner and an applicability decision.

APP Applicability 1 item

  • APP-1-RQ-01

PRE Preparation 43 items

  • PRE-1-RQ-01
  • PRE-1-RC-01
  • PRE-1-RQ-02
  • PRE-1-RC-02
  • PRE-1-RQ-03
  • PRE-1-RQ-04
  • PRE-1-RQ-05
  • PRE-2-RQ-01
  • PRE-2-RQ-02
  • PRE-2-RC-01
  • PRE-2-RQ-03
  • PRE-2-RC-02
  • PRE-2-RC-03
  • PRE-3-RC-01
  • PRE-3-RQ-01
  • PRE-4-RQ-01
  • PRE-4-RQ-02
  • PRE-5-RC-01
  • PRE-5-RQ-01-RE
  • PRE-5-RC-02
  • PRE-5-RC-03
  • PRE-5-RC-04
  • PRE-6-RQ-01
  • PRE-6-RQ-02
  • PRE-7-RQ-01
  • PRE-7-RQ-02
  • PRE-7-RQ-03
  • PRE-7-RQ-03-RE
  • PRE-7-RQ-04
  • PRE-7-RQ-05
  • PRE-7-RC-01
  • PRE-7-RQ-06
  • PRE-7-RQ-07
  • PRE-7-RQ-07-RE
  • PRE-8-RQ-01
  • PRE-8-RQ-02
  • PRE-9-RQ-01
  • PRE-9-RQ-02
  • PRE-9-RQ-03
  • PRE-9-RQ-04
  • PRE-10-RQ-01
  • PRE-10-RQ-02
  • PRE-10-RQ-03

RCP Receipt 13 items

  • RCP-1-RQ-01
  • RCP-1-RQ-02
  • RCP-1-RQ-03
  • RCP-1-RC-01
  • RCP-2-RQ-01
  • RCP-2-RQ-02
  • RCP-2-RQ-04
  • RCP-3-RQ-01
  • RCP-4-RQ-01
  • RCP-5-RC-01
  • RCP-6-RQ-01
  • RCP-7-RQ-01
  • RCP-7-RQ-02

VRF Verification 6 items

  • VRF-1-RQ-01
  • VRF-1-RQ-02
  • VRF-2-RQ-01
  • VRF-2-RQ-02
  • VRF-2-RQ-03
  • VRF-2-RQ-04

RMD Remediation 5 items

  • RMD-1-RQ-01
  • RMD-1-RQ-02
  • RMD-2-RQ-01
  • RMD-2-RQ-02
  • RMD-3-RQ-01

RLS Release 10 items

  • RLS-1-RQ-01
  • RLS-1-RQ-02
  • RLS-1-RQ-03
  • RLS-1-RQ-04
  • RLS-2-RQ-01
  • RLS-2-RQ-02
  • RLS-2-RQ-03
  • RLS-2-RQ-03-RE
  • RLS-2-PM-01
  • RLS-2-RC-01

PRA Post-release 1 item

  • PRA-1-RQ-01

50 mandatory14 recommended10 conditional4 risk-gated1 permitted pren-40000-1-3-2025-clause-5 · 0.1.0

How it holds up

Four mechanisms. Each one can say no.

Status is computed, never ticked.

Expired evidence turns an item back into a gap.

A refusal names the requirement.

Shown on a blocked transition Record at least one affected component (RCP-3-RQ-01 / RCP-4-RQ-01)

Handling the case is the paperwork.

Each guarded step links its own evidence as the work is done.

The pack proves itself offline.

One digest, three places report.html · cites sha256
evidence_index.csv · lists sha256
policy-v1.2.pdf · hashes to sha256

Try it

Link evidence. Watch the status compute.

There is no done flag. Click a row to link its artifact, then let one expire.

edge-router-x1 · sample

4 requirements · status recomputed on every change

All four satisfied

The same rule runs the real assessment: an artifact past its review date is a gap again, and the audit pack says so.

Who it is for

The manufacturers who never had a PSIRT.

Networking, optics, IoT, industrial. EU revenue at stake and a standard written in PSIRT vocabulary.

Week one

Register the product Owners on all 79 items Advisories in 繁體中文 and English

One person holding both the PSIRT-manager and duty-officer roles is a supported configuration, not a workaround.

Week one

One person, two roles Invite the second pair of eyes Public CVD form live

Component and module makers whose customers demand CRA-aligned vulnerability handling by contract.

Week one

Per-product scope Audit pack on demand Evidence, not promises

Start with one product.

Create a workspace, register a product, and the full requirement list is instantiated against it. Nothing exists until you follow the confirmation link we send you.

Create a workspace Log in Contact Auray

Made possible by Auray Technology

Built with the people who assess you.

AuCRA SHIELD is made possible by Auray Technology, whose team works with manufacturers on CRA readiness and conformity assessment. When you are ready to go beyond self-assessment, talk to them.

Contact Auray

Managed by Auray Technology