Have you checked Zealience python script for GEC-1 (EN 18031)?

[zealience]

Challenges of GEC-1

The GEC-1 requirement is a bit of an oddball in EN 18031. It asks manufacturers to document all their software and hardware components along with any associated vulnerabilities. This can lead to thousands of items to be documented!

Unfortunately, the existing vulnerability management tools just don’t make a cut because they do not support GEC-1 documentation specific needs. GEC-1 requires manufacturers to detail the paths through the Decision Trees, along with their results and justifications for each software and hardware component and vulnerability. No tools out there have the capability to handle this, which is exactly why we created this open-source script.

How does the script work? Our script ingests your SBOM and VDR (Vulnerability Disclosure Report). It parses the data contained in these files and automatically generates two CSV files:

• Documentation of software
• List of the vulnerabilities affecting the software

Many IoT manufacturers have already utilized this script to successfully prepare their GEC-1 documentation. Some of them have gone to Notified Bodies and got their certifications.

Feel Free to Use the Script 😊

🚀The script is available here: https://github.com/zealience/en18031-vulnerability-documentation
📖Step-by-step guidance is available here: https://zealience.com/resource-hub/gec-1-everything-you-need-to-know

[kkubal]

The script is really helpful and greatly simplifies the data flow between Dependency-Track and EN 18031 documentation. In my slowly but steadily built vulnerability-management system, it makes handling large sets of data much more manageable. Based on my experience, I came up with a few improvements that make analyzing the output files even easier in practice:

• EPSS integration (score, percentile, fetch date) retrieved from the first.org API and added to ListVuln.csv. Dependency-Track does not provide this data, so having it directly in the output makes prioritization smoother, though it does increase runtime.

• Split of the GEC-1 detail column into five fields (detailGec1Dn1 … detailGec1Dn5), aligned with the decision nodes, which simplifies documentation work. The original detailGec1 column is essentially redundant, since this information is already available in another sheet.

• Optional KEV catalog support. When a CISA KEV JSON is provided, the script adds a kev flag (yes/no), vendor, and product, which delivers additional and often interesting context about vulnerabilities already exploited in the wild.

I’m not entirely sure if I can share my modified version publicly due to licensing considerations. If Zealience is interested, I’d be happy to send it over for review — both to verify the legal side and to assess whether these enhancements are worth publishing.

[zealience]

Hi @kkubal!
Thank you very much for your message, happy to hear that you found the script useful. The extra features you've implemented sound really promising!

Would you like to integrate your features into the script repo? You can open a pull request, we'd be happy to review your suggested changes and merge them if everything's ok. Alternatively, you can send your script via email to info@zealience.com.
Regarding the license, as long as you're fine with your changes to be licensed under MIT, there's no problem for us! It's an open source project, and we welcome contributors :)