🛡️ Riksdagsmonitor — CRA Conformity Assessment

Evidence-Driven Conformity Through Systematic Assessment
Demonstrating CRA Compliance for Swedish Parliament Intelligence Platform

📋 Document Owner: CEO | 📄 Version: 1.4 | 📅 Last Updated: 2026-05-06 (UTC) 🔄 Review Cycle: Quarterly | ⏰ Next Review: 2026-08-06 🏢 Owner: Hack23 AB (Org.nr 5595347807) | 🏷️ Classification: Public

🎯 Purpose Statement

Hack23 AB's CRA conformity assessment process demonstrates how systematic regulatory compliance directly enables business growth rather than creating operational burden. This assessment documents Riksdagsmonitor's compliance with the EU Cyber Resilience Act (CRA), providing evidence-based self-assessment of cybersecurity requirements for our Swedish Parliament intelligence platform.

As a cybersecurity consulting company, our approach to CRA compliance becomes a showcase of professional implementation, demonstrating to potential clients how systematic regulatory adherence creates competitive advantages through robust security foundations while enabling EU market access.

— James Pether Sörling, CEO/Founder

🔍 Purpose & Scope

This process provides a concise, repeatable CRA Conformity Assessment for Riksdagsmonitor. Aligns with CRA Annex I & V, Hack23 classification, secure development, and transparency policies.

Scope: Riksdagsmonitor platform within Asset Register requiring EU market placement.

Process Alignment: This assessment follows the CRA Conformity Assessment Process template and is governed by the Open Source Policy for open source compliance requirements.

📚 Architecture Documentation Map

📚 Reference Implementations

The following Hack23 AB projects demonstrate completed CRA assessments:

1️⃣ Project Identification

Supports CRA Annex V § 1 - Product Description Requirements

📋 Evidence Links:

• 🏗️ System Architecture: ARCHITECTURE.md — Complete C4 model architecture
• 🔐 Security Architecture: SECURITY_ARCHITECTURE.md — Defense-in-depth security controls
• 🛡️ Future Security Vision: FUTURE_SECURITY_ARCHITECTURE.md — Security roadmap
• 📊 Data Architecture: DATA_MODEL.md — Data structures, schemas, relationships
• 🔄 Process Workflows: FLOWCHART.md — Data processing and CI/CD workflows
• 🧠 System Overview: MINDMAP.md — Conceptual system relationships
• 🎯 Strategic Analysis: SWOT.md — Strategic assessment
• 🎯 Threat Analysis: THREAT_MODEL.md — STRIDE and MITRE ATT&CK mapping
• 🔧 CI/CD Pipelines: WORKFLOWS.md — 43 workflow automation documentation

📊 Project Status & Quality Badges:

📋 Data Sources Evidence:

• 🏛️ Swedish Parliament: data.riksdagen.se — Parliamentary members, committees, documents, votes
• 🗳️ Election Authority: val.se — Election data, parties, voting results
• 📊 SCB (Statistics Sweden): scb.se — PxWebAPI 2.0 (scb-mcp) — official Swedish statistics (economy, labour, population, education, environment)
• 🌍 World Bank Open Data: data.worldbank.org — WGI governance, environment, long-horizon social/education (world-bank-mcp)
• 🌐 IMF Open Data: data.imf.org — macro/fiscal/monetary/external-sector freshness + T+5 projections (WEO, Fiscal Monitor, IFS, GFS_COFOG); consumed via pure-TypeScript client scripts/imf-client.ts (Datamapper JSON + SDMX 3.0) — not an MCP server, SBOM-covered via npm (ADR 0001)
• 🕵️ CIA Platform: Citizen Intelligence Agency — 19 intelligence products, risk assessments, analytics

2️⃣ CRA Scope & Classification

Supports CRA Article 6 - Scope and Article 7 - Product Classification Assessment

🏢 CRA Applicability (Select One):

🌐 Distribution Method (Select One):

📋 CRA Classification (Select One):

📝 CRA Scope Justification: Riksdagsmonitor is a non-commercial open-source static website providing Swedish Parliament transparency services through data visualization and news generation. As a volunteer-driven initiative with community distribution via GitHub under Apache 2.0 license, it falls under non-commercial OSS with Standard CRA classification enabling self-assessment approach. The static site architecture (HTML/CSS/JS with no server-side execution) significantly reduces the attack surface compared to traditional web applications.

📋 Classification Evidence:

• 📜 Open Source License: Apache 2.0 License
• 🏛️ Classification Framework: ISMS Classification Policy
• 📊 Public Repository: GitHub Repository

🔍 Classification Impact:

• Standard: Self-assessment approach (this document provides evidence)
• Class I/II: Would require notified body assessment + additional documentation

3️⃣ Technical Documentation

Supports CRA Annex V § 2 - Technical Documentation Requirements

📋 Comprehensive ISMS Integration:

• 🏗️ Architecture & Design: Complete Architecture + Security Architecture + Future Vision + Future Security
• 📊 Asset Management: Asset Register
• 🔒 Security Controls: Information Security Policy + Network Security Policy
• 🔧 Development Process: Secure Development Policy + CI/CD Evidence

4️⃣ Risk Assessment

Supports CRA Annex V § 3 - Risk Assessment Documentation

Reference: 📊 Risk Assessment Methodology and ⚠️ Risk Register

⚖️ CRA Risk Statement: LOW — Static site architecture eliminates entire categories of server-side vulnerabilities. Comprehensive security controls and evidence-based monitoring support CRA essential cybersecurity requirements. ✅ Risk Acceptance: James Sörling, CEO Hack23 AB — February 2026

📋 Risk Management Framework Evidence:

• 📊 Methodology: Risk Assessment Framework
• ⚠️ Risk Tracking: Active Risk Register
• 🔄 Business Continuity: Continuity Planning
• 🆘 Disaster Recovery: Recovery Procedures
• 📈 Risk Monitoring: Security Metrics

5️⃣ Essential Cybersecurity Requirements

Supports CRA Annex I - Essential Requirements Self-Assessment

🎯 CRA Self-Assessment Status: EVIDENCE_DOCUMENTED

🔍 Security Implementation Evidence:

• 🛡️ Static Site Security: No server-side code execution eliminates SQL injection, RCE, SSRF, and authentication bypass vulnerabilities
• 🔒 Transport Security: HTTPS-only via AWS CloudFront (TLS 1.3) and GitHub Pages
• 📊 Supply Chain: SHA-pinned GitHub Actions, Dependabot, CodeQL, step-security/harden-runner
• 🔐 Content Integrity: Subresource Integrity (SRI) for CDN-loaded Chart.js and D3.js libraries

6️⃣ Conformity Assessment Evidence

Supports CRA Article 19 - Conformity Assessment Documentation

📊 Quality & Security Automation Status:

Reference: 🛠️ Secure Development Policy

🎖️ Security & Compliance Badges:

🔍 Supply Chain Security:

🛡️ Security Scanning:

📊 Quality & Testing:

⚖️ License:

7️⃣ Post-Market Surveillance

Supports CRA Article 23 - Obligations of Economic Operators

Reference: 🌐 ISMS Transparency Plan and 📊 Security Metrics

📋 CRA Reporting Readiness: Documentation and procedures prepared for ENISA incident reporting per 🚨 Incident Response Plan

🔗 ISMS Monitoring Integration:

• 📊 Continuous Monitoring: Security Metrics Framework
• 🌐 Transparency Strategy: ISMS Transparency Plan
• 🤝 Third-Party Management: Supplier Monitoring
• ✅ Compliance Tracking: Regulatory Adherence
• 💾 Data Protection: Backup and Recovery

8️⃣ EU Declaration of Conformity

Supports CRA Article 28 - EU Declaration of Conformity

🏢 Manufacturer: Hack23 AB, Gothenburg, Sweden 📦 Product: Riksdagsmonitor v0.9.40 📋 CRA Compliance: Self-assessment documentation supporting CRA essential cybersecurity requirements evaluation 🔍 Assessment: Self-assessment documentation per Article 24 (non-commercial OSS with standard classification) 📊 Standards: ISO/IEC 27001 security framework + OWASP web security guidelines + NIST SSDF secure development

📅 Date & Signature: 2026-05-06 — James Sörling, CEO Hack23 AB

📂 Technical Documentation: This assessment + evidence bundle supports CRA Annex V technical documentation requirements

9️⃣ Assessment Completion & Approval

Supports CRA Article 16 - Quality Management System Documentation

📊 CRA Self-Assessment Summary

Overall CRA Documentation Status: EVIDENCE_DOCUMENTED

Key CRA Documentation Areas:

• ✅ Annex I essential requirements documented with comprehensive evidence links
• ✅ Annex V technical documentation comprehensively structured
• ✅ Article 11 security measures implemented and documented
• ✅ Article 23 post-market surveillance procedures operational

Static Site Security Advantage: Riksdagsmonitor's static site architecture provides inherent security benefits:

• No server-side code execution (eliminates SQL injection, RCE, SSRF)
• No user authentication/session management (eliminates authentication bypass, session hijacking)
• No database (eliminates data breach risks)
• No cookies/tracking (GDPR compliant by design)
• CDN-distributed content (inherent DDoS resilience)

✅ Formal Approval

📊 CRA Assessment Status: SELF_ASSESSMENT_DOCUMENTED

🎨 CRA Assessment Maintenance

📋 Update Triggers

Per CRA Article 15 - Substantial Modification

CRA assessment updated only when changes constitute "substantial modification" under CRA:

1. 🏗️ Security Architecture Changes: New trust boundaries, encryption, or deployment topology
2. 🛡️ Essential Requirement Impact: Changes affecting Annex I compliance
3. 📦 Critical Dependencies: New supply chain components with security implications (e.g., new CDN libraries)
4. 🔍 Risk Profile Changes: New threats or vulnerability classes affecting political data integrity
5. ⚖️ Regulatory Updates: CRA implementing acts or guidance changes

🎯 Maintenance Principle: Assessment stability preferred — avoid routine updates that don't impact CRA compliance

📚 CRA Regulatory Alignment

🔐 CRA Article Cross-References

• Article 6: Scope determination → Section 2 (CRA Classification)
• Article 11: Essential cybersecurity requirements → Section 5 (Requirements Assessment)
• Article 19: Conformity assessment → Section 6 (Evidence Documentation)
• Article 23: Post-market obligations → Section 7 (Surveillance Documentation)
• Article 28: Declaration of conformity → Section 8 (DoC Template)
• Annex I: Technical requirements → Section 5 (Requirements self-assessment mapping)
• Annex V: Technical documentation → Complete template structure

🌐 ISMS Integration Benefits

• 🔄 Operational Continuity: CRA self-assessment integrated with existing security operations
• 📊 Evidence Reuse: Security metrics and monitoring serve dual ISMS/CRA documentation purposes
• 🎯 Business Value: CRA readiness demonstrates cybersecurity consulting expertise
• 🤝 Client Confidence: Transparent self-assessment showcases professional implementation methodology

📋 Complete ISMS Policy Framework

🔐 Core Security Governance

• 🔐 Information Security Policy — Overall security governance
• 🏷️ Classification Framework — Data and asset classification
• 🌐 ISMS Transparency Plan — Public disclosure strategy

🛡️ Security Control Implementation

• 🔒 Cryptography Policy — Encryption standards, TLS configuration
• 🔑 Access Control Policy — Identity management, repository access
• 🌐 Network Security Policy — HTTPS-only, CDN security
• 🏷️ Data Classification Policy — Public political data handling

⚙️ Operational Excellence Framework

• 🛠️ Secure Development Policy — SDLC security, testing requirements
• 📝 Change Management — Controlled modification procedures
• 🔍 Vulnerability Management — Security testing, coordinated disclosure
• 🤝 Third Party Management — Supplier risk assessment
• 🔓 Open Source Policy — OSS governance, license compliance
• 🛡️ CRA Conformity Assessment Process — CRA self-assessment template and methodology

🚨 Incident Response & Recovery

• 🚨 Incident Response Plan — Security event handling
• 🔄 Business Continuity Plan — Business resilience
• 🆘 Disaster Recovery Plan — Technical recovery procedures
• 💾 Backup Recovery Policy — Data protection and backup

📊 Performance Management & Compliance

• 📊 Security Metrics — KPI tracking, continuous improvement
• 💻 Asset Register — Asset inventory with risk classifications
• 📉 Risk Register — Risk identification, assessment, treatment
• 📊 Risk Assessment Methodology — Systematic risk evaluation
• ✅ Compliance Checklist — Regulatory requirement tracking

🔓 Open Source Policy Conformity

Demonstrating compliance with Hack23 AB Open Source Policy

🎖️ Security Posture Evidence (OSP §1)

Requirement	Status	Evidence
OpenSSF Scorecard ≥7.0	✅ Active
Quality Gate Passed	✅ Active	Quality Checks Workflow
License Badge	✅ Active
Threat Model Published	✅ Active
STRIDE Analysis Complete	✅ Active

📋 Governance Artifacts (OSP §2)

🔒 Security Implementation (OSP §3)

📊 License Compliance (OSP §4)

🏷️ Classification & Documentation (OSP §5)

🔐 Data Protection (OSP §6)

🤝 Third-Party Contributions (OSP §7)

📋 CRA Conformity Assessment Process Alignment

Demonstrating compliance with Hack23 AB CRA Conformity Assessment Process

Process Step Completion Matrix

Classification Selections

Classification Dimension	Selected Value	Justification
🏪 Market Category		Apache 2.0 licensed, freely available on GitHub
🛡️ Confidentiality		All data from public government sources
✅ Integrity		Political data accuracy is essential for democratic trust
⏱️ Availability		99.998% design availability (AWS CloudFront multi-region + GitHub Pages DR), automated failover
🕐 RTO		GitHub Pages DR available within hours
🔄 RPO		Git-based continuous backup, daily content generation
🏢 CRA Applicability		Volunteer-driven, no revenue model
🌐 Distribution		GitHub public repository
📋 CRA Classification		Not in Annex III/IV critical categories

Control-by-Control CRA Requirements Mapping

CRA Annex I Part I — Essential Cybersecurity Requirements

This section provides a systematic mapping of all 13 essential cybersecurity requirements from CRA Annex I, Part I to Riksdagsmonitor implementations.

CRA Annex I Part II — Vulnerability Handling Requirements

CRA Conformity Assessment Approach

Assessment Method: Self-Assessment (Module A - Internal Production Control)

Riksdagsmonitor qualifies for self-assessment under CRA Article 32(1) as it is:

• A standard product with digital elements (not critical or important category per Annex III/IV)
• Non-commercial open-source software distributed publicly without charge
• A civic transparency tool with low risk profile (no safety functions, no critical infrastructure)

Self-Assessment Process:

1. Technical Documentation (CRA Annex V): Complete — this document and linked ISMS documents
2. Design and Development Assessment: Complete — THREAT_MODEL.md, SECURITY_ARCHITECTURE.md
3. Production Controls: Complete — CI/CD pipeline with security gates documented in WORKFLOWS.md
4. Conformity Declaration: Template in Section 8 of this document
5. CE Marking: Applicable upon formal EU market placement (currently pre-commercial)

Assessment Conclusion:

Open Item: SBOM automation (Annex I Part II Req 1) — planned Q1 2027 via GitHub SBOM generation feature.

CRA Readiness Checklist for Future Versions

This section provides a forward-looking readiness checklist for when Riksdagsmonitor formally enters EU market distribution as a commercial product.

Pre-Market Readiness Assessment

Security Update Lifecycle Timeline

flowchart LR
    VULN_DISCOVERED[Vulnerability Discovered] --> ASSESS[Severity Assessment]
    ASSESS --> CRITICAL{Critical CVSS 9+?}
    CRITICAL -->|Yes| PATCH_7[Patch within 7 days]
    CRITICAL -->|No| HIGH{High CVSS 7-8.9?}
    HIGH -->|Yes| PATCH_30[Patch within 30 days]
    HIGH -->|No| MED{Medium CVSS 4-6.9?}
    MED -->|Yes| PATCH_90[Patch within 90 days]
    MED -->|No| PATCH_SCHED[Patch in next release]
    PATCH_7 --> DEPLOY[Deploy Security Update]
    PATCH_30 --> DEPLOY
    PATCH_90 --> DEPLOY
    PATCH_SCHED --> DEPLOY
    DEPLOY --> NOTIFY[Notify via SECURITY.md Advisory]
    NOTIFY --> ENISA_CHECK{Significant incident?}
    ENISA_CHECK -->|Yes| ENISA_REPORT[Report to ENISA within 24h]
    ENISA_CHECK -->|No| CLOSE[Close Vulnerability Record]
    ENISA_REPORT --> CLOSE
Copy

CRA Article 13 Manufacturer Obligations Tracking

CRA Article 14 Reporting Obligations

Active Exploitation Reporting (Article 14(2)):

• Notification timeline: Within 24 hours of becoming aware
• Recipient: ENISA Early Warning notification system
• Content: Product identification, vulnerability description, known exploited instances
• Contact: security@hack23.com (internal) → ENISA online notification form

Severe Incident Reporting (Article 14(3)):

• Notification timeline: Within 72 hours of detection
• Recipient: Competent market surveillance authority (MSA) and ENISA
• For Sweden: Swedish Post and Telecom Authority (PTS) as likely MSA
• Content: Detailed incident report including impact, affected versions, remediation

User Notification (Article 14(8)):

• If security update available: Notify users via GitHub Security Advisories
• If vulnerability affects user security: Post advisory on riksdagsmonitor.com
• Update README.md security section for significant vulnerabilities

CRA Product Categories and Risk Classification

Classification Under CRA Annex III and IV

Riksdagsmonitor must be evaluated against CRA's product classification system to determine the applicable conformity assessment route:

CRA Annex III — Important Products with Digital Elements (Class I):

Conclusion: Riksdagsmonitor does not qualify as a Class I Important Product under Annex III.

CRA Annex IV — Critical Products with Digital Elements (Class II):

Conclusion: Riksdagsmonitor does not qualify as a Class II Critical Product under Annex IV.

Final Classification: Standard Product with Digital Elements — eligible for Module A Self-Assessment

Open Source Software Considerations (CRA Article 16)

Riksdagsmonitor benefits from the CRA open source carve-out provisions:

Compliance Strategy: Maintain full CRA technical documentation now, enabling smooth transition to formal commercial compliance when API tier launches in 2027.

CRA Declaration of Conformity Template (Draft)

The following template will be formalized upon entry into EU commercial distribution:

EU DECLARATION OF CONFORMITY
Riksdagsmonitor - Version [X.Y]

Hack23 AB (Org.nr 5595347807)
Sweden

This declaration of conformity is issued under the sole responsibility
of the manufacturer.

Product: Riksdagsmonitor - Swedish Parliamentary Transparency Platform
Version: [X.Y]
Description: Web-based civic technology platform providing access to
  Swedish Riksdag parliamentary data, voting records, and AI-generated
  political news in 14 languages.

Conformity Assessment Method: Module A (Self-Assessment)
Product Category: Standard product with digital elements
Annex III/IV Category: Not applicable

The object of the declaration described above is in conformity with
the relevant Union harmonisation legislation:

Regulation (EU) 2024/2847 - Cyber Resilience Act
  - Annex I Part I: Essential cybersecurity requirements (13/13 compliant)
  - Annex I Part II: Vulnerability handling requirements (7/8 compliant)
  - Annex V: Technical documentation available at:
    github.com/Hack23/riksdagsmonitor/blob/main/CRA-ASSESSMENT.md

Signed for and on behalf of: James Pether Sorling, CEO
Date: [To be completed upon formal market placement]
Place: Sweden
Copy

📋 Document Control: ✅ Approved by: James Pether Sörling, CEO 📤 Distribution: Public 🏷️ Classification: 📅 Effective Date: 2026-05-06 ⏰ Next Review: 2026-08-06 🎯 CRA Alignment: Follows CRA Conformity Assessment Process template — supports CRA Annex V technical documentation and self-assessment requirements 🔓 OSS Alignment: Conforms with Open Source Policy — governance artifacts, security posture evidence, license compliance 🏢 ISMS Integration: Comprehensive alignment with public ISMS framework for operational excellence 🎯 Framework Compliance:

🌐 IMF Integration — CRA Third-Party Services Inventory

Effective: 2026-04-24 · Authoritative hub: analysis/imf/README.md · analysis/imf/agentic-integration.md · analysis/imf/indicators-inventory.json · analysis/imf/data-dictionary.md · .github/aw/ECONOMIC_DATA_CONTRACT.md

IMF in third-party services inventory (CRA Annex V evidence)

Why IMF strengthens our CRA posture

• Eliminates a credential-management surface that a commercial economic-data provider would introduce
• Eliminates a supply-chain dependency on a single commercial vendor
• Eliminates GDPR DPIA scope (no PII)
• Provides redundancy via two independent endpoints (Datamapper + SDMX)

Egress hosts (allow-list): www.imf.org (Datamapper REST · WEO/FM, unauthenticated), api.imf.org (SDMX 3.0 REST · IFS/BOP/DOTS/GFS/PCPS/ER/MFS_IR/MFS_PR, subscription-key authenticated via the Azure APIM Ocp-Apim-Subscription-Key header / IMF_SDMX_SUBSCRIPTION_KEY secret). Both HTTPS-only; payloads are public macro statistics with no PII.

Canonical rule. Every economic claim in a Riksdagsmonitor article cites an IMF dataflow first; World Bank citations are reserved for governance, environment and social residue (the classes IMF does not publish). SCB is the Swedish-specific ground truth layer. See ECONOMIC_DATA_CONTRACT.md v2.1 for the banned-phrase list and vintage discipline (>6 mo → annotation).

🔗 Hack23 Ecosystem

🗳️ Empower citizens · 🔍 Strengthen democratic accountability · 🕵️ Illuminate the political process

_{© 2008–2026 Hack23 AB (Org.nr 559534-7807) · Maintainer: James Pether Sörling, CISSP CISM}