Method
One product, a fixed catalogue, and a report that separates what was observed from what the lab is willing to recommend. The work is independent product assurance. It is not official certification and it is not a Cyber Resilience Act conformity assessment.
Sequence
Scoping is part of the work, not a formality. The recommendation is only as wide as the decision you named and the unit the lab had.
You describe the product, the ecosystem around it, and the decision the report must serve: ship, source, or deploy. The lab confirms what is in the box and what will not be tested.
One unit, the companion app, a hub if the product needs one, a test account you control, and any supplier documents you already have.
The 22 cases. A case is marked N/A only when the architecture makes it inapplicable. Observations are kept with the evidence that supports them.
A 2-page decision summary, a 10–15 page technical report, and machine-readable results. The recommendation is one of the four statements below.
After you remediate, a shorter pass over the cases that failed or were inconclusive, and an updated summary.
From you
Not this engagement
Specimen
This is the structure of the documents, not a result. There is no client, no product, and no verdict in the example. Bracketed text is a slot the real report fills.
Page 1
Product [product name supplied by the client]
Ecosystem [sensor, hub, app, as named in the scope]
Decision [ship, source, or deploy]
Recommendation [Proceed / Proceed with conditions / Do not proceed pending remediation / Insufficient evidence]
Conditions [each one tied to a case ID, or none]
Limitations [what bounds the recommendation]
Not tested [cases in scope that were not run]
Case SEC-01 · Network exposure
Verdict [Pass / Fail / N/A / Not Tested / Inconclusive]
Observation [what was reachable, from where, in the agreed scenarios]
Evidence [capture or measurement reference]
Criterion [the pass/fail line agreed at scoping]
Mapping [related theme, for orientation only — not a conformance claim]
The rest of the technical report is scope and setup, method notes, the same block for every case, reliability figures with their method, the document review for GOV-01 to GOV-04, and the limitations again.
One record per case. JSON is the default file. The record does not include a combined score, because the lab does not produce one.
{
"product": "[name supplied by the client]",
"decision": "ship | source | deploy",
"recommendation": "Proceed | Proceed with conditions | Do not proceed pending remediation | Insufficient evidence",
"cases": [
{
"id": "SEC-01",
"title": "Network exposure",
"verdict": "Pass | Fail | N/A | Not Tested | Inconclusive",
"observation": "[what was seen]",
"evidence": ["[reference]"],
"limitations": ["[what bounds this result]"]
}
]
}Vocabulary
Decision summary, Technical report, Machine-readable results — and the lists below. A Proceed recommendation covers this catalogue, the decision in the scope, and the unit tested. It is not a statement that the product is secure in general.