Glossary

The European vocabulary is authoritative in English; the French term is given where it is in common internal use.

A

Actively exploited vulnerability — A vulnerability for which there is reliable evidence that a malicious actor has exploited it in a system without permission. Trigger for the 24-hour deadline.

ADCO — Administrative Cooperation Group of market surveillance authorities; organises coordinated sweeps.

AGPL — Affero General Public License. A network copyleft licence: making a service available online triggers the source-provision obligation. → Licence families

Annex I — Essential requirements. Part I: product security. Part II: vulnerability handling. → Essential requirements

Annex II — Information and instructions to the user. → User information

Annex III — Important products: Part I (class I), Part II (class II).

Annex IV — Critical products.

Annex V — Content of the EU declaration of conformity.

Annex VII — Content of the technical documentation.

Annex VIII — Conformity assessment procedures (modules).

ANSSI — The French national cybersecurity agency.

Attestation, provenance — A signed statement describing how an artefact was produced. → Signing

C

CE marking — The manufacturer’s declaration, under its sole responsibility, that the product meets the applicable requirements. → CE marking

CPE — Common Platform Enumeration. A historical product identifier, imprecise, a major cause of false positives. → Identifiers

CRA — Cyber Resilience Act, Regulation (EU) 2024/2847.

CSAF — Common Security Advisory Framework 2.0, an OASIS standard for machine-readable security advisories, with a VEX profile.

CSIRT, coordinating — The national response team designated to receive reports.

CVD — Coordinated vulnerability disclosure. → Disclosure policy

CVE — Common Vulnerabilities and Exposures. A public vulnerability identifier.

CVSS — Common Vulnerability Scoring System. Intrinsic severity score.

CycloneDX — The OWASP SBOM format, standardised as ECMA-424. → CycloneDX

D

Distributor — An operator that makes a product available without manufacturing or importing it. → Economic operators

Due diligence — The obligation to assess third-party components before integrating them, and to document that assessment.

E

ENISA — The European Union Agency for Cybersecurity. Operates the single reporting platform and contributes to the EUVD.

EPSS — Exploit Prediction Scoring System. Short-term exploitation probability.

EUCC — The European cybersecurity certification scheme adopted under Regulation (EU) 2019/881.

EU declaration of conformity — The document by which the manufacturer attests conformity. → Declaration

EUVD — European Vulnerability Database, created under NIS 2 and operated by ENISA. → Continuous monitoring

F

FPGA — Field-programmable gate array. Falls under class I where it carries security-related functionalities.

H

Harmonised standards — European standards whose references are cited in the Official Journal and which confer a presumption of conformity.

I

Importer — An operator established in the Union that places on the market a product from a third country.

in-toto — A framework for attestations about the build chain.

Incident, severe — An event affecting the product’s ability to protect availability, authenticity, integrity or confidentiality. A reporting trigger.

M

Making available on the market — Any supply in the course of a commercial activity, after the first.

Manufacturer — A person who develops or has a product developed and markets it under their own name or trademark. Carries the bulk of the obligations.

Modules A / B / C / H — The conformity assessment procedures in Annex VIII. → Conformity assessment

N

NANDO — The European Commission’s database of notified bodies.

NIS 2 — Directive (EU) 2022/2555, concerning entities rather than products.

Notified body — An accredited conformity assessment body, designated and notified to the Commission.

NVD — National Vulnerability Database. The US database, CPE correlation.

O

Open-source software steward — A legal person, other than a manufacturer, providing systematic and sustained support to free software intended for commercial activities. A lightened regime. → Steward

OSV — Open Source Vulnerabilities. A per-ecosystem database, PURL correlation, high precision.

P

PDE — Product with digital elements. → Scope

Placing on the market — The first making available of a product on the Union market. The moment at which conformity is assessed.

Presumption of conformity — The effect of applying harmonised standards, common specifications or a certification scheme.

PPE — Poisoned Pipeline Execution. An attack that makes the build chain run unreviewed code, brought in by a pull request, in a context holding secrets. → Securing the build chain

PSIRT — Product Security Incident Response Team.

PURL — Package URL. The canonical per-ecosystem identifier, to be preferred. → Identifiers

R

Reachability — Whether a vulnerable function can actually be called from your entry points. A central prioritisation criterion. → False positives

RED — Directive 2014/53/EU on radio equipment, and Delegated Regulation (EU) 2022/30.

Remote data processing solution — Processing designed by the manufacturer whose absence would prevent the product from performing one of its functions. How the cloud enters the CRA.

Backport — Applying a fix to an earlier version without changing the upstream version number. A frequent cause of false positives.

Immutable reference — A commit or content hash, as opposed to a version tag, which can be repointed. → Locking dependencies

Lock file — A record of the exact resolution of dependencies, transitive ones included, with their hashes. The precondition for reproducibility. → Locking dependencies

S

SBOM — Software bill of materials. → SBOM

Scorecard — OpenSSF Scorecard. An open tool running eighteen automated checks on a repository and deriving a score out of 10, which makes diligence computable. → Assessing a component

S2C2F — Secure Supply Chain Consumption Framework. An OpenSSF framework describing how to consume open source in a controlled way, with a maturity model. → Assessing a component

security.txt — The RFC 9116 standardised file stating the contact point for vulnerability reports.

Sigstore — A signing infrastructure with a transparency log.

SLSA — A framework of build chain maturity levels.

SPDX — Software Package Data Exchange. The Linux Foundation SBOM format, standardised as ISO/IEC 5962. Its licence list is authoritative. → SPDX

SRP — Single reporting platform, operated by ENISA. → Reporting

Substantial modification — A change that alters the intended purpose or affects conformity. Reopens the assessment.

Support period — The period during which the manufacturer produces security updates. At least five years, unless the expected lifetime is shorter. → Support period

T

Technical documentation — The set of items required by Annex VII. → Technical documentation

Transitive dependency — A dependency dragged in by one of your dependencies, without your declaring it. → Quality

V

VEX — Vulnerability exploitability exchange. A structured assertion about the exploitability status of a vulnerability in a given product. → VEX