CRA Dossier

Gap list

Product: COOK version 2.0.0 Manufacturer: Bilal El Homsi Generated: 2026-10-24 by cra-dossier 0.1.0 from the repository cook at commit cd17b114fbab Regulation: Regulation (EU) 2024/2847 (Cyber Resilience Act), OJ L, 2024/2847, 20.11.2024, http://data.europa.eu/eli/reg/2024/2847/oj

DRAFT generated from the repository for the manufacturer to review, complete and sign. This is not legal advice. This document makes no claim that the product conforms to Regulation (EU) 2024/2847 and no claim about CE marking; conformity is declared only by the manufacturer, on its sole responsibility, after completing the human items in the gap list.

Statuses: Evidence found (the repository or the answers show it, with the file and line), Partly shown (a signal exists, the requirement is not shown to be met), Not found (nothing in the repository; build or write it), Manufacturer decision (a judgment only the manufacturer can make), Declared not applicable (needs an Article 13(4) justification).

Total Evidence Partly Not found Decision Not applicable Open
63 5 29 14 14 1 57

Open items block the signature of the declaration (Article 13(12), Article 28(4)). Overrides go in cra-dossier.answers.jsonc under requirements, one entry per item id, with the evidence file.

Annex I, Part I

Annex I, Part I, point (1): Appropriate level of cybersecurity based on the risks

Annex I, Part I, point (2)(a): No known exploitable vulnerabilities at release

Annex I, Part I, point (2)(b): Secure by default configuration, with reset to original state

Annex I, Part I, point (2)(c): Security updates, automatic where applicable, with notification and opt-out

Annex I, Part I, point (2)(d): Protection from unauthorised access; report possible unauthorised access

Annex I, Part I, point (2)(e): Confidentiality of stored, transmitted or processed data (encryption at rest and in transit)

Annex I, Part I, point (2)(f): Integrity of data, commands, programs and configuration; report corruptions

Annex I, Part I, point (2)(g): Data minimisation

Annex I, Part I, point (2)(h): Availability of essential functions, including after an incident and against denial of service

Annex I, Part I, point (2)(i): Minimise negative impact on other devices or networks

Annex I, Part I, point (2)(j): Limited attack surfaces, including external interfaces

Annex I, Part I, point (2)(k): Exploitation mitigation mechanisms

Annex I, Part I, point (2)(l): Security-related logging and monitoring with a user opt-out

Annex I, Part I, point (2)(m): Secure and easy permanent removal of all data and settings

Annex I, Part II

Annex I, Part II, point (1): Identify and document vulnerabilities and components; machine-readable SBOM of at least top-level dependencies

Annex I, Part II, point (2): Address and remediate vulnerabilities without delay; security updates separate from feature updates where feasible

Annex I, Part II, point (3): Effective and regular security tests and reviews

Annex I, Part II, point (4): Publicly disclose fixed vulnerabilities (description, affected product, impact, severity, remediation)

Annex I, Part II, point (5): Coordinated vulnerability disclosure policy, in place and enforced

Annex I, Part II, point (6): Facilitate vulnerability information sharing; contact address for reports

Annex I, Part II, point (7): Secure update distribution mechanism, automatic where applicable

Annex I, Part II, point (8): Security updates disseminated without delay, free of charge, with advisory messages

Annex II (user information)

Annex II, point 1: Manufacturer name, postal address, email or other digital contact, website

Annex II, point 2: Single point of contact for vulnerability reports and where the CVD policy is found

Annex II, point 3: Name, type and unique identification of the product

Annex II, point 4: Intended purpose, security environment, essential functionalities, security properties

Annex II, point 5: Known or foreseeable circumstances that may lead to significant cybersecurity risks

Annex II, point 6: Internet address of the EU declaration of conformity (where applicable)

Annex II, point 7: Type of technical security support and the end date of the support period

Annex II, point 8: Detailed secure-use instructions: commissioning, changes, installing updates, decommissioning and data removal, turning off automatic updates, integrator information

Annex II, point 9: Where the SBOM can be accessed, if the manufacturer makes it available to users

Article 13 (manufacturer obligations)

Article 13(2) and (3): Cybersecurity risk assessment, documented and kept updated

Article 13(5): Due diligence on third-party and open-source components

Article 13(6): Report vulnerabilities found in components to their maintainers

Article 13(7): Systematic documentation of cybersecurity aspects and vulnerabilities

Article 13(8): Support period determined and recorded

Article 13(9): Security updates stay available for at least 10 years or the remainder of the support period

Article 13(12): Technical documentation, conformity assessment, EU declaration of conformity, CE marking before placing on the market

Article 13(13): Keep the technical documentation and the declaration for at least 10 years or the support period

Article 13(14): Procedures to keep series production in conformity; take account of changes

Article 13(15): Type, batch or serial number or other identifying element

Article 13(16): Manufacturer name, address, email, website on the product or accompanying document

Article 13(17): Single point of contact, easily identifiable, not limited to automated tools

Article 13(18): Annex II information and instructions accompany the product

Article 13(19): Support period end date shown at the time of purchase; end-of-support notification where feasible

Article 13(20): EU declaration of conformity (or the simplified one with the exact URL) provided with the product

Article 13(21): Corrective measures, withdrawal or recall on non-conformity

Article 13(22): Provide information to market surveillance authorities on reasoned request

Article 13(23): Inform authorities and users before ceasing operations

Article 14 (reporting, in application since 11 September 2026)

Article 14: Reporting of actively exploited vulnerabilities and severe incidents (24 h, 72 h, 14 days or 1 month) via the single reporting platform; inform users

Annex VII (technical documentation completeness)

Annex VII, point 1(a): Intended purpose

Annex VII, point 1(b): Versions: 2.0.0; covered: 2.0.0 (versionCode 32, live on the dApp Store since 2026-10-09) and later patch builds that are not substantial modifications; the Kitchen fee model changed in 2.0 (build 32), which the manufacturer treats as the version this documentation covers.

Annex VII, point 1(c): Software product: no hardware photographs or layout (justified by the product type)

Annex VII, point 1(d): Annex II user information (05_user_information.md)

Annex VII, point 2(a): Design and architecture description (answers plus the scanned component list)

Annex VII, point 2(b): Vulnerability handling: SBOM, CVD policy, contact address, update distribution

Annex VII, point 2(c): Production (build and release) and monitoring processes and their validation

Annex VII, point 3: Cybersecurity risk assessment (03_risk_assessment.md)

Annex VII, point 4: Information taken into account for the support period (06_support_period.md)

Annex VII, point 5: No harmonised standard applied; the solutions adopted are described per Annex I item (allowed by Annex VII point 5 where standards have not been applied)

Annex VII, point 6: Test reports: 94 test files found; reports of security tests are to be attached

Annex VII, point 7: Copy of the EU declaration of conformity (draft included, unsigned)

Annex VII, point 8: SBOM available for a reasoned request (sbom.cdx.json)