CRA Compliance Kit for IoT Devices

Meet EU Cyber Resilience Act (CRA) requirements in one pip install.

Key Deadlines

What This Kit Provides

Quickstart

pip install cra-compliance-kit

from cra_kit.identity import DeviceIdentityService, TrustTier
from cra_kit.firmware import FirmwareHealthService
from cra_kit.input_guard import InputClassifier
from cra_kit.action_guard import PhysicalActionGuard

# 1. Enrol devices with tiered trust
identity = DeviceIdentityService()
identity.enrol_device("sensor-01", "temperature_sensor", trust_tier=TrustTier.ENVIRONMENTAL)

# 2. Check firmware against CVE database
fw = FirmwareHealthService()
check = fw.check_device("sensor-01", "gateway", "1.5.3")
print(f"Vulnerable to {len(check.vulnerabilities_found)} CVEs")

# 3. Sanitize every input
classifier = InputClassifier()
safe, findings = classifier.is_safe(user_input)

# 4. Restrict dangerous actions
guard = PhysicalActionGuard()
result = guard.check_action("format_storage")
assert result["allowed"] == False  # Hard blocked

# 5. Generate SBOM
python -m sbom.generator --product "MyIoTGateway" --version "2.1.0" --output sbom.xml

CRA Article Mapping

Architecture Overview

Each module is self-contained with zero external dependencies (stdlib only). Modules store state in SQLite at ~/.cra_kit/ for persistence.

User Input
    |
    v
InputClassifier  ── detects 8 injection families (prompt, code, SQL, command, XSS, SSRF, traversal, format string)
    |
    v
DeviceIdentityService  ── authenticates, checks trust tier (0-4)
    |
    v
PhysicalActionGuard  ── blocks/confirms dangerous actions, time-gated at night
    |
    v
FirmwareHealthService  ── matches version against CVE database
    |
    v
SBOM Generator (CycloneDX 1.5 XML)

Open-Core Licensing

Requirements

• Python 3.9+
• SQLite (built into Python standard library)
• Zero external dependencies

Who Built This

StarTeQ Ltd — the team behind Starcaller, a privacy-first AI appliance with a 9.3/10 security trust score and 8-module security stack in production.

Contact: info@starcaller.uk Website: starcaller.uk/cra-compliance

CRA Watch — Live Vulnerability Monitoring

Monitor your registered products in real time at the CRA Watch Dashboard.

• Daily CISA KEV polling at 06:00 UTC
• NVD + EPSS enrichment on-demand
• CycloneDX VEX generation
• ENISA Article 14 notification drafts
• 24hr / 72hr / 14-day deadline tracking