VCRI TARA Builder

A Value Chain Risk Institute tool, built to sit next to the Cyber Manual. The Cyber Manual Builder fills the Cyber Manual Movement's user-information template (CRA Annex II). This tool is the risk-assessment side (CRA Annex VII (3)). Import a manual to start from its interfaces, components, functions and conditions of use; export the accepted risks back in the manual's own shape (circumstances leading to risk and condition-of-use candidates grouped per function, for the manual's chapter 3.3 subchapters, and security-property candidates for 2.2). The Movement's guidance is explicit that the manual's risk list is not the full risk assessment; this is where the full one lives. The Cyber Manual Movement working group owns the template, guidance, boilerplate and examples; it has not adopted or reviewed this tool. Scenario classes and scoring anchors are VCRI's own, CC BY 4.0.

1 · Product model

The product with digital elements under assessment. Use Connect, From a manual file (top bar) to seed this from a Cyber Manual Builder export: interfaces from PI and PP, assets from PC, plus the manual's functions and conditions of use for reference. Or enter it directly.

Intended purpose & environment Interfaces (the attack surface). Click to toggle; add custom ones. Assets & damage scenarios: what an attacker could harm, and the resulting damage. + Asset

2 · Threat scenarios

Generated, not blank-page: eight assumption-violation classes crossed with your interfaces produce candidate scenarios. Accept, edit, or discard. (Classes authored by VCRI; no text reproduced from paywalled standards.)

⚙ Generate candidate scenarios

4 · Risk register & treatment

Feasibility × impact → risk. Choose a treatment per scenario and, where you know it, the function it affects (FC) or the condition of use it would violate (CU). User-borne treatments become condition-of-use candidates in the affected function's chapter 3.3 subchapter; manufacturer-borne ones become security-property candidates for 2.2. Every accepted risk becomes a circumstance-leading-to-risk (CR) row in its function's 3.3 subchapter (3.4.1 for the update function).

5 · Annex VII summary, Annex I trace, and what goes back into the manual

The assessment as a CRA-shaped summary, then the same content in the Cyber Manual template's shape (v0.39): per function, the circumstances leading to risk (CR) and condition-of-use candidates for its chapter 3.3 subchapter; then security-property candidates for 2.2. Indicative, not a conformance claim.