Self-assessment

To be completed quarterly, by the committee, on the basis of verifiable facts — not impressions. Each answer is yes only if evidence can be produced within the hour.

Assessment date: ____________ Participants: ______________________

Module 1 — Scope and classification

• The portfolio is fully qualified: every product has a signed PDE sheet
• Exclusions relied on are documented by a reasoned sheet
• Every in-scope product has a co-signed classification sheet
• The consolidated classification register exists and was reviewed less than a year ago
• Class II and Critical products are identified, and a notified body is contractually engaged for each
• The assessment route for each product is decided and documented

Score: ___ / 6

Module 2 — SBOM and tooling

• A pivot format is decided and applied uniformly
• The SBOM is generated automatically by the build chain across all active products
• A quality score is computed and a threshold is blocking in CI
• SBOMs are signed and accompanied by a provenance attestation
• A steering platform ingests every SBOM produced
• Continuous monitoring covers all shipped versions, not just the latest
• Tooling is pinned and documented per product family

Score: ___ / 7

Module 3 — Vulnerabilities and disclosure

• Remediation SLAs are written, published internally and measured
• Uncorrected vulnerabilities carry a VEX with a standardised justification
• Security advisories are published for fixed vulnerabilities
• A CVD policy is published and the contact point is live
• The security.txt file is online and its Expires field is in the future
• A register of reports received exists and is kept
• The ratio of actionable alerts is measured and tracked over time

Score: ___ / 7

Module 4 — Reporting capability

• A technical and legal on-call rota exists, with named deputies
• A written delegation of the decision to report is in force
• Live accounts on the reporting platform exist and were tested less than six months ago
• Templates for early warning, notification and final report are ready
• The list of Member States where each product is made available is maintained
• A register of decisions to report or not is kept, with the reasoning
• A timed exercise took place in the last six months, and the interval achieved is under 24 hours

Score: ___ / 7

Module 5 — Documentation and evidence

• A technical documentation template exists and is used
• Every product placed on the market has complete, frozen technical documentation
• EU declarations of conformity are signed by an authorised person
• Annex II user notices are shipped, with the end-of-support date
• Each product’s support period is determined, justified and communicated
• An evidence vault with ten-year archiving is in place
• A retrieval exercise took place within the year, and it succeeded

Score: ___ / 7

---

Results

Module	Score	Out of	Level
1. Scope and classification		6
2. SBOM and tooling		7
3. Vulnerabilities and disclosure		7
4. Reporting capability		7
5. Documentation and evidence		7
Total		34

Reading the levels, per module:

Share of “yes”	Level	Interpretation
Under 30 %	Initial	The topic is identified, nothing is tooled
30 to 60 %	Building	Blocks exist, without continuity
60 to 85 %	Operational	The arrangement works, blind spots remain
Over 85 %	Managed	The arrangement is under control; the issue is sustaining it

The three questions that outrank the score

Whatever the total, three negative answers justify immediate action:

1. Is module 4 complete? The reporting deadline has passed and applies to the legacy portfolio.
2. Are notified bodies engaged for class II and Critical products? It is the only lead time you do not control.
3. Did the retrieval exercise succeed? It is the only control that proves archiving works.

Use

Archive each dated assessment. Progress between two assessments is more informative than the absolute score, and it is progress that goes to the executive committee.