Budget, resources and scenarios
Items to provision
| Item | Investment | Recurring |
|---|---|---|
| Steering platform | Integration, migration | Licence or operations |
| Generators and CI integration | Development of shared scripts | Maintenance |
| Evidence vault and archiving | Set-up, indexing | Storage, migrations |
| Notified bodies | First assessment per product | Extensions, reassessments |
| Certification of critical products | Security target, laboratory | Certificate maintenance |
| PSIRT and on-call cover | Recruitment, tooling | Salaries, rota |
| Compliance and legal | Clause set, templates, training | Watch, reviews |
| Long support maintenance | Preserved build environments | Backports, over 5 to 10 years |
| Training | Producing the materials | Recurring sessions |
| Exercises and audits | First cycle | Six-monthly and annual |
Profiles needed
| Profile | Role | Indicative load |
|---|---|---|
| Product compliance lead | Keeps the registers, drives the technical files, interfaces with authorities | Full time from wave 0 |
| Application security engineer | Tooling, CI integration, SBOM quality | Full time during waves 2 and 3 |
| PSIRT analyst | Triage, VEX, advisories, reporting | Full time from wave 1 |
| Lawyer | Classification, contracts, reporting decisions | Part time, with on-call |
| Per-team product champion | Applies, remediates, documents | Part time, across all teams |
On-call cover is the most frequently forgotten item: a 24-hour obligation requires a rota, therefore a minimum headcount, and compensation.
Three scenarios
Scenario A — Minimally compliant
Content. Open tooling, self-hosted platform, evidence vault on existing infrastructure, on-call cover shared with existing rotas, technical documentation written in-house, notified bodies only where mandatory.
What it covers. The obligations, with no margin.
Residual risk: low tolerance for the unexpected. A major incident coinciding with an authority request saturates the team. Long support maintenance is the item that will crack first, around year three.
Who it suits: a limited portfolio, mostly default-category products.
Scenario B — Recommended
Content. Scenario A, plus: a dedicated PSIRT team with its own on-call rota, a commercial tool on the weakest link — usually licensing or reachability — an identified backport budget, two exercises a year, an annual external audit.
What it covers. The obligations, with the capacity to absorb an incident and to last.
Residual risk: acceptable and named.
Who it suits: most organisations with important products under Annex III.
Scenario C — Ambitious
Content. Scenario B, plus: an integrated enterprise platform, reachability analysis, a customer portal with machine-readable SBOMs and advisories, reproducible builds, participation in standardisation work, CVE numbering authority status.
What it covers. The obligations, and a differentiating commercial position.
Who it suits: critical products, a large installed base, regulated sectors, or a strategy of differentiation through transparency.
Decision table
| A — Minimal | B — Recommended | C — Ambitious | |
|---|---|---|---|
| Covers the obligations | Yes, no margin | Yes | Yes |
| Withstands a major incident | With difficulty | Yes | Yes |
| Holds over ten years | Uncertain | Yes | Yes |
| Commercial argument | No | Partial | Yes |
| Residual risk | High | Moderate | Low |
| Decision required | Accept the risk, by name | Fund | Fund and arbitrate the portfolio |
Trade-offs to settle
- In-house or outsourced PSIRT and on-call cover? Outsourcing reduces fixed cost but transfers product knowledge poorly, and product knowledge is the heart of qualification.
- Open or commercial tooling? The recommendation is to start open in order to measure, then invest against the observed gap — not the advertised one.
- Which scope first? Class II and Critical products first, then those with the highest Union turnover.
- What to do about products whose compliance costs more than they earn? That is a portfolio decision, to be taken explicitly rather than endured. It is legitimate and must be documented.
What to ask the committee for
A written decision on: the scenario chosen, the residual risk accepted with the name of whoever accepts it, the budget in investment and recurring terms, and the products removed from the portfolio where applicable.
A scenario chosen without a named acceptance of the residual risk is not a decision: it is a deferral.