Search papers, labs, and topics across Lattice.
This paper introduces an automated framework for generating Assurance Cases (ACs) tailored for compliance with the EU Cyber Resilience Act (CRA), leveraging an agentic Retrieval-Augmented Generation (RAG) method grounded in Claim-Argument-Evidence logic. The framework was validated through a case study on Catalink's PATROLIoT wildfire monitoring system, successfully generating 70 ACs with a high grounding density of approximately 4.4 artefacts per AC. The approach not only achieved a Natural Language Inference (NLI) evaluator accuracy of 0.88 but also provided expert-validated plausibility scores, demonstrating its effectiveness in streamlining cybersecurity compliance processes for SMEs.
Automating Assurance Case generation could drastically reduce the resource burden on SMEs striving for compliance with the EU Cyber Resilience Act.
Complying with the EU Cyber Resilience Act (CRA) is a resource-intensive challenge for SMEs due to the complexity of cybersecurity conformity assessment. Yet, it is essential for demonstrating regulatory compliance and ensuring product security and resilience. To address this, we introduce an automated framework for generating Assurance Cases (ACs) using an agentic Retrieval-Augmented Generation grounded in a formal Claim-Argument-Evidence logic. By systematically mapping technical documentation requirements, the framework streamlines the generation of certification evidence. We validate our approach on a case study of Catalink's PATROLIoT wildfire monitoring system, where the agentic RAG generated 70 ACs with high grounding density (~4.4 artefacts per AC). The proposed Natural Language Inference (NLI) evaluator achieves 0.88 accuracy, which provides robust evidence grounding and traceability, while expert-validated plausibility (3.06) supports interpretable justifications. For practitioners, this work provides a scalable, interpretable approach for automating mandatory CRA conformity assessments, reducing manual effort while maintaining transparent decision support.
