03.md -> Adding a proposal to how due diligence can be implemented

content/03.md

@@ -1,5 +1,36 @@
 # What and how to record due diligence, evidence
-
+Article 13(5) mandates that due diligence be **risk-proportional**. Integrating components with active **Article 25 Voluntary Security Attestations** allows manufacturers to accelerate evaluation by establishing an immediate baseline of trust, shifting internal audit resources toward high-risk or un-attested dependencies.
 ## Levels of due diligence
+Because open source components vary widely in both architectural impact and system privileges, due diligence under the Cyber Resilience Act cannot be executed as a uniform, one-size-fits-all audit. Article 13(5) expects manufacturers to establish a risk-proportional evaluation model that scales scrutiny based on the component's exposure, access level, and the risk classification of the parent product. By categorizing dependencies into distinct operational tiers, organizations can strategically deploy deep technical resources where risk is highest.
+
+```text
+                  ┌─────────────────────────────────────┐
+                  │    LEVEL 3: HEIGHTENED SCRUTINY     │
+                  │  Kernel, Auth, Crypto, Network OS   │
+                  ├─────────────────────────────────────┤
+                  │    LEVEL 2: STANDARD SCRUTINY       │
+                  │ Application Features, Non-Sensitive │
+                  ├─────────────────────────────────────┤
+                  │    LEVEL 1: BASIC SCRUTINY          │
+                  │ Sandboxed Utilities, Static Assets  │
+                  └─────────────────────────────────────┘
+```
+
+#### Level 1: Basic Scrutiny (Low-Risk / Sandboxed Components)
+* **Target Components:** Non-critical utilities, isolated design libraries, or static assets with no network access, file system access, or administrative privileges.
+
+#### Level 2: Standard Scrutiny (Core Application Dependencies)
+* **Target Components:** open source frameworks, database drivers, and business-logic libraries executing within user-space without system-level privileges.
+
+#### Level 3: Heightened Scrutiny (Critical & High-Exposure Components)
+* **Target Components:** Cryptographic modules, authentication systems, network parsers, embedded operating systems (e.g., Yocto, Linux kernels), or components integrated into **Class I / Class II Important Products** (e.g., firewalls, hypervisors) [1, 4].
+
+## What has to be checked
+When evaluating a third-party open source component prior to integration and continuously throughout its lifecycle, manufacturers must audit four core criteria. The table below illustrates how to satisfy or streamline these requirements:
 
-## What has to be checked
+| Evaluation Criteria | Due Diligence Check |
+| :--- | :--- |
+| **Cybersecurity Policy** | The declared cybersecurity policy of a project and the fact sustaining the project execution of the policy is a key resource to understand the support manufacturers will get to comply with the CRA obligatinos. Reviewing repository history for security contact response times, CVD compliance and checking the `SECURITY.md` deliver useful insights that helps to evaluate the suitability of a component. |
+| **Governance & Health** | The cybersecurity policy is a key element, but it is not enough to asses a component. The governance, how decisions are made and by whom as well as the contribution policy, usually set in the `CONTRIBUTING.md`, are also relevant to decide what responsibilities and role will be taken by the manufacturers. |
+| **Code Quality & Testing** | The approach of the project to code quality and testing is also a decision factor. The risks, attack surface and overall quality of the component is tightly linked to these activities, so it is recommended to understand the project's processes to make sure that undesired effects are included in the product impacting the cybersecurity posture.|
+| **Licensing Hygiene** |Validate all embedded component licenses to protect IP and prevent legal or commercial liabilities (e.g., copyleft risks). This process should be sustained by machine readable formats like SPDX or CycloneDX.  |