An Alignment Between the CRA's Essential Requirements and the ATT&CK's Mitigations

2025-05-19

AI Summary

Regulatory requirements under the EU’s Cyber Resilience Act (CRA) often lack direct technical operationalization, creating a gap between legal mandates and cybersecurity practice. Method: This study conducts the first structured, rule-based qualitative mapping between CRA’s foundational security requirements and MITRE ATT&CK v14.1 mitigation techniques to assess alignment and identify gaps. Contribution/Results: The analysis reveals strong overall alignment between CRA and ATT&CK mitigations; however, three CRA requirements—secure data erasure, data minimization, and vulnerability coordination—lack corresponding ATT&CK mitigations. Conversely, ATT&CK exhibits coverage gaps in four critical domains: threat intelligence sharing, supply chain security, secure software development lifecycle (SSDLC), and compliance auditing. These findings provide empirical evidence for cross-framework governance and advance the technical implementability of cybersecurity regulations by clarifying actionable mappings and structural deficiencies.

Technology Category

• Application Domains: Security
• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories
• Computer Vision: Adversarial Attacks & Robustness

Application Category

• Responsible Web: Consent frameworks and practices on the web
• Search and Retrieval-Augmented AI: Web evaluation methodologies and metrics
• Security and Privacy: Cyber-crime defenses and forensics

Abstract

The paper presents an alignment evaluation between the mitigations present in the MITRE's ATT&CK framework and the essential cyber security requirements of the recently introduced Cyber Resilience Act (CRA) in the European Union. In overall, the two align well with each other. With respect to the CRA, there are notable gaps only in terms of data minimization, data erasure, and vulnerability coordination. In terms of the ATT&CK framework, gaps are present only in terms of threat intelligence, training, out-of-band communication channels, and residual risks. The evaluation presented contributes to narrowing of a common disparity between law and technical frameworks.

Problem

• Aligns MITRE ATT&CK mitigations with EU Cyber Resilience Act requirements
• Identifies gaps in data minimization and erasure in CRA compliance
• Highlights ATT&CK framework gaps in threat intelligence and training

Innovation

• Aligns ATT&CK mitigations with CRA requirements
• Identifies gaps in data and threat handling
• Bridges legal and technical framework disparities