Compliance overview
This site is MiWire’s public product documentation for the RouDem. It is written so that one set of pages serves three readers: customers, who need the information and instructions that EU law requires a manufacturer to provide; assessors, who need evidence for the technical file; and security researchers, who need to know how to report a problem. Developer documentation is kept elsewhere.
Standards and regulations served
Section titled “Standards and regulations served”| Standard | What it asks of the documentation |
|---|---|
| EU Cyber Resilience Act (CRA), Annex II | Information and instructions to the user: manufacturer identity and contact, product identification, intended purpose and security environment, where to report vulnerabilities, the support period, how updates are installed, where the SBOM can be obtained, decommissioning instructions. |
| CRA, Annex I | Among the essential requirements: secure by default, automatic security updates, minimised attack surface, secure deletion, vulnerability handling, an SBOM in the technical file. The pages here are the user-facing side of those requirements. |
| Radio Equipment Directive (RED), delegated regulation 2022/30, via EN 18031-1/-2 | Documentation of network interfaces and services, update mechanism, user notification of updates, logging and its opt-out. |
| LAC-BCOP-1 (Latin American and Caribbean best current operational practice for CPE security) | General requirements GR-01 to GR-05 (device description, software and open-source inventory, disclosure contact, out-of-support notice), vendor requirements VR-01 to VR-04 (support policy, security fixes, coordinated disclosure, public support site), FR-07 (documented communications), MR-08 (recovery). |
Where each item is
Section titled “Where each item is”| Requirement | Item | Page |
|---|---|---|
| CRA Annex II (1), BCOP GR-01 | Manufacturer name and contact | Identification |
| CRA Annex II (2), BCOP GR-01 | Product identification: model, hardware, OS, firmware naming | Identification |
| CRA Annex II (3) | Intended purpose and security environment | Product overview |
| CRA Annex II (4), BCOP VR-03, GR-04 | Where and how to report vulnerabilities; security.txt | Reporting vulnerabilities, /.well-known/security.txt |
| CRA Annex II (5), BCOP VR-01, VR-02, GR-05 | Support period, end-of-support dates, what happens then | Support policy |
| CRA Annex II (6) | Secure installation, operation and use | First access, Services page |
| CRA Annex II (7), CRA I.3(b), BCOP MR-07 | How security updates are installed; user-initiated check | Firmware updates |
| CRA I.3(e), II(7), BCOP MR-04, MR-05 | Updates are authenticated; signing keys | Update signing |
| CRA Annex II (8), CRA II(1), BCOP GR-02, GR-03 | Where the SBOM, the software list and the open-source inventory can be obtained | SBOM and component lists, Firmware releases |
| CRA Annex II (9), CRA I.3(l), BCOP IR-07 | Decommissioning and secure deletion | Factory reset and decommissioning |
| BCOP FR-01, IR-01, FR-10, CRA I.3(i), EN 18031-1 GEC-4 | Network services and interfaces, defaults | Services and ports |
| BCOP FR-07, CRA Annex II | Communications with the vendor and third parties | Communications |
| GDPR Art 13, CRA I.3(k) (logging and its opt-out) | Data processed, retention, opt-out | Data processed |
| BCOP FR-08 | User can disable non-essential services | Services page |
| BCOP MR-08 | Anti-bricking and recovery | Recovery |
| BCOP VR-04 | Public, registration-free support site with advisories and release information | This site; Advisories, Firmware releases |
Software bill of materials
Section titled “Software bill of materials”MiWire publishes the SBOM of every firmware release on this site, on the page of that release under Firmware releases, in CycloneDX JSON, together with the package manifest and the list of services enabled at boot. See SBOM and component lists.
Items still pending
Section titled “Items still pending”Some pages carry a visible “Pending” note where a decision or a feature has not been finalised: the support window and end-of-support dates, the disclosure mailbox and response targets, the firmware signing key fingerprints, the legal review of the data page, the customer factory reset and the recovery procedure. Each note says what is pending; the page is updated when it is resolved.