This repo defines the organizational compliance framework for the EU Cyber Resilience Act (CRA, Regulation 2024/2847)， It serves simultaneously as a policy framework and a self-certification checklist, covering program governance, SBOM quality, vulnerability handling, regulatory reporting , OSS stewardship, and technical file obligations.