Adding the seed of Chapter 1

content/01.md

@@ -1 +1,32 @@
-# What is due diligence
+# Due diligence in the scope of the CRA
+
+Due diligence is the process by which manufacturers can demonstrate that the inclusion of a new
+component does not compromise the security posture of the final product, a demonstration that is
+becoming increasingly critical under the Cyber Resilience Act (CRA).
+
+The implementation of a due diligence process necessitates the consideration of three key elements,
+which align with the CRA's focus on security throughout the product lifecycle:
+
+* **Visibility**: The ability to analyse the component. The availability of a
+  Software Bill of Materials (SBOM) is typically instrumental in achieving this objective, as the
+  CRA emphasises the need for transparency and documented evidence regarding the security properties
+  of product components.
+* **Vigilance**: The CRA mandates continuous compliance, making the ability to monitor for existing
+  vulnerabilities essential for understanding the level of exposure a manufacturer assumes upon
+  integration of a component. This ongoing vigilance is a core requirement for maintaining a secure
+  product over its expected lifetime.
+* **Maintenance**: The level of community activity is an important factor for determining the risk
+  profile that a particular component introduces to a product. A poorly maintained component
+  represents a higher risk of unpatched vulnerabilities, which directly conflicts with the CRA's
+  requirement for manufacturers to ensure the timely and effective handling of security updates.
+
+CRA requires the due diligence to be done at the integation time of the open source components to
+the products. Due diligence should be
+done for all releases of a product in the product lifecycle.
+While the principles of due diligence are clear, their application is significantly complicated by
+the widespread inclusion of third-party components, particularly
+Free and Open Source Software (FOSS). FOSS constitutes a vast and diverse ecosystem, ranging from
+massive, professionally supported projects to small, volunteer-maintained repositories. This
+inherent diversity, in terms of community activity, maintenance practices, and documentation
+quality, presents a fundamental challenge to consistently and accurately assessing the three key due
+diligence elements (Visibility, Vigilance, and Maintenance) required under the CRA.

mkdocs.yml

@@ -1,6 +1,6 @@
 site_name: White paper on due diligence obligation of manufacturers
 nav:
-  - Chapter 1 - What is due diligence: 01.md
+  - Chapter 1 - Due diligence in the scope of the CRA: 01.md
   - Chapter 2 - To what do we apply due diligence: 02.md
   - Chapter 3 - What and how to record due diligence, evidence: 03.md
   - Chapter 4 - What happens when due diligence fails: 04.md