Product and security information under CRA Annex II
Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber
Resilience Act, CRA) requires the manufacturer to give users nine items of information, listed in Annex II.
This page answers each of them for WKL Database Gateway Manager and the VBA class WklGatewayClient, or names
where the answer is. Text of the regulation: https://eur-lex.europa.eu/eli/reg/2024/2847/oj.
Information that depends on the version – the version itself and the end of the support period – is in the
files MANUFACTURER.md and SECURITY.md. Every delivery brings them, filled in for its version: in the share
and the ZIP beside the starter, and after an installation with the Windows Installer package in the program
folder WKL/GatewayManager.
The nine items
| No. | Item under Annex II | Answer |
|---|---|---|
| 1 | Name, registered trademark, postal address, email address and website of the manufacturer | EMSR DATA, D.O.O., Trg komandanta Staneta 8, 1000 Ljubljana, Slovenia; https://wvds.it; email addresses in MANUFACTURER.md. Trademarks: The White Knight Labs, WKL. This also applies when you get the product through a distribution partner such as DATECpro GmbH |
| 2 | Single point of contact for vulnerabilities and where the coordinated vulnerability disclosure policy is | SECURITY.md: whom to report to, what a report should contain and how the manufacturer handles it |
| 3 | Name and type of the product and further information for its unique identification | WKL Database Gateway Manager, an Access application to administer the data service WKL Database Gateway, with the VBA class WklGatewayClient. The version is in MANUFACTURER.md and in the entry version of the file deploy/app-manifest.json of the delivery |
| 4 | Intended purpose, security environment, essential functions and security properties | see Purpose, environment and security properties |
| 5 | Known or foreseeable circumstances that may lead to significant cybersecurity risks | see Circumstances with significant risk |
| 6 | Internet address of the EU declaration of conformity | Beta versions have no EU declaration of conformity. A released version comes with the simplified declaration, which gives the internet address of the full one |
| 7 | Type of technical security support and end of the support period | Security updates as separate, free fix releases for the newest version of each major version; each version is supported for five years from the month it was delivered. The end for your version is in MANUFACTURER.md and SECURITY.md. Beta versions are supported until the next beta version, for at most three months; the end is in MANUFACTURER.md |
| 8 | Detailed instructions and information | see Instructions for use and decommissioning |
| 9 | Where the software bill of materials is, if the manufacturer makes it available to users | If the delivery contains a folder SBOM, it holds the software bills of materials (CycloneDX) of the app, the WKL libraries delivered with it and the ODBC driver |
Purpose, environment and security properties
Purpose. Administrators of the data service use the app to grant and revoke access to databases: persons, keys, second factor, rules, assignments of Windows accounts and SQL logins, sign-in policy, data sources. They read the change log, audit and sign-ins and create evidence reports. Developers call the same commands with the VBA class from their own Access and Office solutions.
Environment. A Windows workstation with Access from Microsoft 365 or Office LTSC 2024 (full version or Runtime, 32-bit or 64-bit) and a connection to the operator's data service. The app connects only to the data service whose address you enter when signing in. It sends no data to the manufacturer.
Security properties.
- The app changes nothing by itself: the data service checks and saves every change and writes it to its change log with the actor and the values before and after.
- For the right to administer, the data service requires a second factor with every sign-in method; this can be turned off only in its configuration file on the server.
- Keys leave the data service only as a one-time link; the app shows no key and stores none in its file.
- The app deletes local intermediate data that contains personal data when you sign out.
- The starter checks every copy of the app against the delivery and starts none that doesn't match.
Details: Administrator guide, section "Security and privacy".
Circumstances with significant risk
| Circumstance | Consequence | What you do about it |
|---|---|---|
| A person with the right to administer acts carelessly or maliciously, or their account is taken over | They can grant rights, issue keys and loosen the sign-in policy | give the right admin to few people only; review administration changes regularly |
| Someone may write to the delivery folder | They can replace the app; the starter detects only incomplete or accidentally changed files | treat write access to the folder like administrator rights (setup notes) |
| Someone may write the data service's store file on the server | They can also change the change log; it isn't tamper-proof | protect the server and the store file; file evidence reports regularly |
| A key without a second factor falls into the wrong hands | Access within the person's rules until the key is locked or expires | sign-in policy with a code from outside, expiry date, lock it |
| A workstation with an Access version without security updates | Vulnerabilities in Access stay open | use Access from Microsoft 365 or Office LTSC 2024 |
| The app carries no code signature | Windows SmartScreen or application control warns or blocks; a planted file can't be recognized by a signature | distribute the delivery only from a source you trust |
| Exported lists and evidence reports | They contain names and accounts and are outside the app | store them only where the logs belong, and delete them according to your deletion policy |
Instructions for use and decommissioning
| No. 8 | Topic | Instruction |
|---|---|---|
| a | Secure commissioning and use over the lifetime | How to set up the administration app: users need only read access to the delivery folder. Then set up the second factor for all administrators and the sign-in policy |
| b | How changes to the product affect data security | Changes to rules, sign-in policy, assignments and data sources apply to all users of the data service, not only to the app; each is in the change log. The check box Schlüssel speichern (Save key) stores your own key in Windows Credential Manager. A new version of the app changes no data of the data service |
| c | How security updates are installed | Copy the new version into the delivery folder as described in Put a new version in place; administrators get it at their next start |
| d | Secure decommissioning and removal of user data | Remove the app: Lokale Daten entfernen (Remove local data) deletes the user's settings and saved keys; the starter removes the rest. Persons, keys and logs are in the data service and stay until you delete them there |
| e | Turning off automatic security updates | Neither the app nor the starter downloads anything from the internet. The starter takes a new version only from the delivery folder that you fill. If you don't put a new version in place, users keep the current one; in the starter's settings (Wkl.Bootstrapper.exe /settings) you can choose the previous version |
| f | Information for integration into other products | WklGatewayClient VBA class and HTTP: administration (reference) (data service documentation) |