arXiv cs.CY· Nikolaos Kekatos, Georgios Koutidis, Mihaela Curc\u{a}, Angelos Fountoulakis, Marios Ioannou, Michael Ioannou, Elias Iosif, Paul Lacatus, Alexios Lekidis, Avgi Michael, Tom Nianios·· 10 天前AI 评分22
CYBERFORT：面向中小企业落地《网络弹性法案》的合规链平台
CYBERFORT: A Compliance-Chain Platform Operationalising the Cyber Resilience Act for SMEs
AI 导读
CYBERFORT 是一个开源、以 CRA 为优先的合规平台，通过引导式范围自评、绑定 Annex I 与漏洞处理义务的题库，以及将每个答案关联到控制项、策略和机器存证证据的合规检查引擎，把 CRA 落地为可追溯的合规链。平台已在线上部署，首批服务 43 家组织，并完成了一个 SIEM/XDR 产品的端到端案例研究，覆盖 CRA 各义务章节并含 AI 驱动的整改，受控工作量研究仍在进行中。
正文 · 原文
Authors:Nikolaos Kekatos, Georgios Koutidis, Mihaela Curcă, Angelos Fountoulakis, Marios Ioannou, Michael Ioannou, Elias Iosif, Paul Lacatus, Alexios Lekidis, Avgi Michael, Tom Nianios
Abstract:The EU Cyber Resilience Act (CRA) turns product cybersecurity into a lifecycle compliance obligation for manufacturers, importers, distributors, and integrators of products with digital elements on the EU market, a load that falls largely on small and medium-sized enterprises (SMEs) that rarely have dedicated governance, risk, and compliance (GRC) capacity. We present CYBERFORT, an open-source CRA-first compliance platform developed under the EU Digital Europe Programme and one of twelve projects in the EU CRA cluster. CYBERFORT operationalises the CRA through a guided scope self-assessment, a question bank tied to Annex I and the vulnerability-handling obligations, and a compliance-checking engine that links every answer to controls, policies, and machine-attested evidence, reusing ISO/IEC 27001, NIS2, and GDPR controls only where they coincide with CRA obligations. Its central contribution is the compliance chain, a traceable structure linking each product risk through its controls and policies to the CRA obligations it satisfies, and onward through evidence to the technical-documentation file and EU declaration of conformity, so that every operational gap is traceable and can be closed before market placement. Deployed at this https URL for a first cohort of 43 organisations, the platform is presented with the engineering behind the chain, measured results from a completed end-to-end case study on a SIEM/XDR product with AI-driven remediation spanning the CRA obligation chapters, and the controlled effort study that remains in progress.
| Comments: | 7 pages, 3 figures, 2 tables. Accepted at the 2026 IEEE International Conference on Cyber Security and Resilience (IEEE CSR 2026) |
| Subjects: | Cryptography and Security (cs.CR); Computers and Society (cs.CY); Software Engineering (cs.SE) |
| Cite as: | arXiv:2610.09918 [cs.CR] |
| (or arXiv:2610.09918v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.09918 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Georgios Koutidis [view email]
[v1]
Wed, 7 Oct 2026 12:08:05 UTC (771 KB)
来源：arXiv cs.CY · arxiv.org