Practical template
CRA cybersecurity support decision
Use this template with your own product details and evidence. Copy the text into your document to complete the fields and add rows as needed.
Working record. A fictional or estimated lifetime is not evidence of actual customer use.
- Product/scope: [fill in]
- Decision owner/date: [fill in]
- Expected use and evidence: [fill in]
- Relevant Article 13(8) criteria and rationale: [fill in]
- Proposed support period: [fill in] Applicable legal text/guidance version checked by reviewer: [fill in]
| Dependency | Maintenance horizon/source | Gap against product period | Patch/migration capability | Owner/action/evidence |
|---|---|---|---|---|
| [fill in] | [fill in] | [fill in] | [fill in] | [fill in] |
Update delivery including offline users: [fill in]. Supported release branches: [fill in]. Review of any latest-version policy and conditions: [fill in]. Update availability/retention obligations assessed separately: [fill in].
Customer statement to approve: “Cybersecurity support for [identified product] is provided until [month/year]. Update instructions and supported versions are available at [maintained URL].”
- Approval: [fill in]
- Reassessment triggers: [fill in]
- Customer communication owner: [fill in]
Read the accompanying guide
CRA Support Period for Hardware and How to Document Your Decision