VCRI TARA Builder

A Value Chain Risk Institute tool, built to sit next to the Cyber Manual. The Cyber Manual Builder fills the Cyber Manual Movement's user-information template (CRA Annex II). This tool is the risk-assessment side (CRA Annex VII (3)). Import a manual to start from its interfaces, components, functions and conditions of use; export the accepted risks back in the manual's own shape (circumstances leading to risk per function for 2.6, condition-of-use and security-property candidates). The Movement's guidance is explicit that the manual's risk list is not the full risk assessment; this is where the full one lives. The Cyber Manual Movement working group owns the template, guidance, boilerplate and examples; it has not adopted or reviewed this tool. Scenario classes and scoring anchors are VCRI's own, CC BY 4.0.

1 · Product model

The product with digital elements under assessment. Use Import Cyber Manual JSON (top bar) to seed this from a Cyber Manual Builder export: interfaces from PI and PP, assets from PC, plus the manual's functions and conditions of use for reference. Or enter it directly.

Intended purpose & environment Interfaces (the attack surface). Click to toggle; add custom ones. Assets & damage scenarios — what an attacker could harm, and the resulting damage. + Asset

2 · Threat scenarios

Generated, not blank-page: eight assumption-violation classes crossed with your interfaces produce candidate scenarios. Accept, edit, or discard. (Classes authored by VCRI; no text reproduced from paywalled standards.)

⚙ Generate candidate scenarios

4 · Risk register & treatment

Feasibility × impact → risk. Choose a treatment per scenario and, where you know it, the function it affects (FC) or the condition of use it would violate (CU). User-borne treatments become condition-of-use candidates for the manual's 1.5; manufacturer-borne ones become security-property candidates for 1.2. Every accepted risk becomes a circumstance-leading-to-risk (CR) row under its function's 2.6 subsection.

5 · Annex VII summary, Annex I trace, and what goes back into the manual

The assessment as a CRA-shaped summary, then the same content in the Cyber Manual template's shape (v0.29): circumstances leading to risk (CR) for 2.6, condition-of-use candidates for 1.5, security-property candidates for 1.2. Indicative, not a conformance claim.