Does due diligence cover all manufacturer 3rd party integration obligations?

[CsatariGergely]

There is a discussion in #9 related to the scope of the due diligence. This issue should clarify if the due diligence process covers all the 3rd party integration obligations of a manufacturer or it is only a part of these obligations.

[timop62]

Both the law and the draft guidance seem to leave room for interpretation that leads to either conclusion, due diligence covering many of the manufacturer 3rd party component obligations throughout product life cycle, or due diligence being specific to selection and integration phase of the product development.

We also have additional material we may consider.
CEN/CENELEC JTC13/WG9 has developed a draft horizontal standard for CRA "Cybersecurity requirements for products with digital elements - Principles, product risk management, and lifecycle activities", a.k.a. JT013089 or prEN 40000-1-2.

In this document they have chapter 7 "Product cybersecurity lifecycle activities". There in 7.10 "Third-party component cybersecurity management" in 7.10.1 "Rationale and Guidance" they provide this: "Third-party component cybersecurity management specifies the requirements and activities to ensure that cybersecurity risks relevant to third-party components integrated into the product  are handled with due diligence and other relevant activities. This includes tasks such as: [goes on to list "activities, which include monitoring of vulnerabilities and and communicating newly found and sharing solutions" among other things]."

This leads me to conclude that the writers of the draft standard consider "Third-party component cybersecurity management" is the top level activity and due diligence, vulnerability monitoring, reporting, upstream contributing, etc., are sub-activities to it.

I don't think it is good, if we in ORC define the meaning and scope and relation of due diligence with other 3rd party component cybersecurity management tasks very much differently from the draft standard. Especially as the eventual standards is part of CRA legislative activity and has already undergone scrutiny by the Commission and the HAS consultant, leading one to assume writers' understanding of due diligence is not incorrect.