Key result
MITRE's ATT&CK framework mitigations and the EU's Cyber Resilience Act requirements align well overall, with notable gaps in data minimization, data erasure, and vulnerability coordination.
Why the study?
The study was conducted to narrow a common disparity between law and technical frameworks by evaluating the alignment between the CRA's essential cybersecurity requirements and MITRE's ATT&CK mitigations.
Key points are not available for this paper at this time.
Comparison
MITRE ATT&CK mitigations vs European Union Cyber Resilience Act essential cybersecurity requirements
Design
Alignment evaluation
The evaluation highlights specific gaps between the EU Cyber Resilience Act and the MITRE ATT&CK framework, contributing to narrowing the disparity between legal and technical cybersecurity frameworks.
The paper presents an alignment evaluation between the mitigations present in the MITRE’s ATT&CK® framework and the essential cyber security requirements of the recently introduced Cyber Resilience Act (CRA) in the European Union. In overall, the two align well with each other. With respect to the CRA, there are notable gaps only in terms of data minimization, data erasure, and vulnerability coordination. In terms of the ATT&CK® framework, gaps are present only in terms of threat intelligence, training, out-of-band communication channels, and residual risks. The evaluation presented contributes to narrowing of a common disparity between law and technical frameworks.
No takes yet. Share an insight, caveat, or question.
Ruohonen et al. (2025) studied this question. MITRE's ATT&CK framework mitigations and the EU's Cyber Resilience Act requirements align well overall, with notable gaps in data minimization, data erasure, and vulnerability coordination.
Synapse has enriched 5 closely related papers on similar clinical questions. Consider them for comparative context: