Informational — not legal advice.
All 13 items in this pack have content — no manufacturer input is currently missing.
Annex VII — Technical Documentation
annex7.1.a — General description of the product with digital elements, including its intended purpose.
Derived
Regulation (EU) 2024/2847 (Cyber Resilience Act), consolidated text 02024R2847-20241120 (base act + Corrigenda 1-3, none of which touch Annex V, Annex VII, or Articles 13/31/33), Annex VII, point 1(a).
Northgate FlowMeter Agent is a lightweight software agent that runs on industrial flow-meter controllers, collecting flow-rate telemetry and exposing it over a local network API for plant SCADA systems. Intended purpose: continuous, read-only telemetry reporting for water and gas utility metering installations; it does not actuate or control any physical valve or process.
annex7.1.b — General description must state versions of software affecting compliance with essential cybersecurity requirements.
Derived
Regulation (EU) 2024/2847 (Cyber Resilience Act), consolidated text 02024R2847-20241120 (base act + Corrigenda 1-3, none of which touch Annex V, Annex VII, or Articles 13/31/33), Annex VII, point 1(b).
Scan evidence: vcs.isGitRepo: true
Scan evidence: vcs.tag: "v2.4.0"
Scan evidence: vcs.tagIsRealTag: true
annex7.1.c — For hardware products, photographs or illustrations showing external features, marking and internal layout.
Derived
Regulation (EU) 2024/2847 (Cyber Resilience Act), consolidated text 02024R2847-20241120 (base act + Corrigenda 1-3, none of which touch Annex V, Annex VII, or Articles 13/31/33), Annex VII, point 1(c).
Not applicable — this product is a software-only agent with no accompanying hardware enclosure, external markings, or internal physical layout to photograph or illustrate.
annex7.1.d — User information and instructions as set out in Annex II.
Derived
Regulation (EU) 2024/2847 (Cyber Resilience Act), consolidated text 02024R2847-20241120 (base act + Corrigenda 1-3, none of which touch Annex V, Annex VII, or Articles 13/31/33), Annex VII, point 1(d).
User information and instructions are published as README.md in the product repository and as a PDF Quick Start Guide shipped alongside each release artifact, covering: installation, network configuration, telemetry API authentication, firmware/agent update procedure, and the vulnerability-disclosure contact address referenced in Annex I Part II.
annex7.2.a — Necessary information on the design and development of the product, including drawings/schemes and a description of the system architecture.
Derived
Regulation (EU) 2024/2847 (Cyber Resilience Act), consolidated text 02024R2847-20241120 (base act + Corrigenda 1-3, none of which touch Annex V, Annex VII, or Articles 13/31/33), Annex VII, point 2(a).
The agent is a single-process Node.js service. Architecture: a polling collector thread reads Modbus registers from the attached flow-meter controller, normalizes samples into an internal telemetry buffer, and a local HTTP API (bound to the plant network interface only, never a public interface) serves the buffer to the SCADA integration layer. A design overview diagram is maintained in docs/architecture.md in the product repository.
annex7.2.b — Necessary information and specifications of the vulnerability handling processes: software bill of materials, coordinated vulnerability disclosure policy, contact address for reporting vulnerabilities, and secure update distribution.
Derived
Regulation (EU) 2024/2847 (Cyber Resilience Act), consolidated text 02024R2847-20241120 (base act + Corrigenda 1-3, none of which touch Annex V, Annex VII, or Articles 13/31/33), Annex VII, point 2(b). See also BSI TR-03183-2 v2.1.0 section 5.2.2 (component-level required SBOM data fields, including 'Distribution licences') for what counts as SBOM-readiness evidence.
Scan evidence: security.vulnDisclosurePolicyPresent: true
Scan evidence: packages.count: 2 package(s) identified via dependency scan
Scan evidence: packages.allLicensesKnown: all 2 resolved package(s) have a known license category
annex7.2.c — Necessary information and specifications of the production and monitoring processes of the product and the validation of those processes.
Derived
Regulation (EU) 2024/2847 (Cyber Resilience Act), consolidated text 02024R2847-20241120 (base act + Corrigenda 1-3, none of which touch Annex V, Annex VII, or Articles 13/31/33), Annex VII, point 2(c).
Builds are produced by a CI pipeline that runs the full automated test suite, a dependency vulnerability scan, and a reproducible-build check against a pinned toolchain image before any release artifact is signed and published. Production monitoring: release artifacts are checksum-verified at deploy time; the CI pipeline definition itself is version-controlled and requires a second-reviewer approval before any change.
annex7.3 — An assessment of the cybersecurity risks against which the product is designed, developed, produced, delivered and maintained pursuant to Article 13, including how the essential cybersecurity requirements in Annex I Part I are applicable.
Derived
Regulation (EU) 2024/2847 (Cyber Resilience Act), consolidated text 02024R2847-20241120 (base act + Corrigenda 1-3, none of which touch Annex V, Annex VII, or Articles 13/31/33), Annex VII, point 3.
A cybersecurity risk assessment was carried out covering: unauthorized network access to the telemetry API, tampering with in-transit Modbus readings, and supply-chain compromise of a third-party dependency. Mitigations map to Annex I Part I requirements as follows: network exposure is minimized by binding the API to the internal plant VLAN only (secure-by-default configuration), all dependencies are scanned on every build (vulnerability handling), and the update mechanism is signed and verified before install (secure update requirement). Full risk register maintained internally and available to market surveillance authorities on request.
annex7.4 — Relevant information taken into account to determine the support period pursuant to Article 13(8).
Derived
Regulation (EU) 2024/2847 (Cyber Resilience Act), consolidated text 02024R2847-20241120 (base act + Corrigenda 1-3, none of which touch Annex V, Annex VII, or Articles 13/31/33), Annex VII, point 4.
Support period was set to 5 years from initial placement on the market, based on: the typical 8-10 year operational lifetime of the industrial flow-meter hardware this agent is deployed alongside, current staffing commitment for the security-maintenance team, and alignment with the utility sector's typical multi-year procurement/certification cycles.
annex7.5 — A list of the harmonised standards, common specifications, or European cybersecurity certification schemes applied (in full or in part), or descriptions of the solutions adopted where none were applied.
Derived
Regulation (EU) 2024/2847 (Cyber Resilience Act), consolidated text 02024R2847-20241120 (base act + Corrigenda 1-3, none of which touch Annex V, Annex VII, or Articles 13/31/33), Annex VII, point 5.
No harmonised standards under Article 27 had been published and referenced for this product category as of the support-period start. In their absence, the manufacturer applied IEC 62443-4-2 (security requirements for industrial automation and control system components) as the technical solution adopted to meet the essential cybersecurity requirements in Annex I Parts I and II.
annex7.6 — Reports of the tests carried out to verify conformity of the product and of the vulnerability handling processes with the essential cybersecurity requirements in Annex I Parts I and II.
Derived
Regulation (EU) 2024/2847 (Cyber Resilience Act), consolidated text 02024R2847-20241120 (base act + Corrigenda 1-3, none of which touch Annex V, Annex VII, or Articles 13/31/33), Annex VII, point 6.
Internal conformity test reports (penetration test, dependency vulnerability scan, and fuzz-testing of the Modbus parser) are maintained under docs/compliance/test-reports/ in the product repository and are available to market surveillance authorities on request; not reproduced in full here.
annex7.7 — A copy of the EU declaration of conformity.
Derived
Regulation (EU) 2024/2847 (Cyber Resilience Act), consolidated text 02024R2847-20241120 (base act + Corrigenda 1-3, none of which touch Annex V, Annex VII, or Articles 13/31/33), Annex VII, point 7.
(compiled from the Annex V declaration below)
Annex V point 1 (Name and type and any additional information enabling the unique identification of the product with digital elements.): Northgate FlowMeter Agent, type NG-FMA-2, software agent version identified by the release tag stamped in this pack's header.
Annex V point 2 (Name and address of the manufacturer or its authorised representative.): Northgate Devices GmbH, Rheinallee 42, 55116 Mainz, Germany.
Annex V point 3 (A statement that the EU declaration of conformity is issued under the sole responsibility of the provider.): This EU declaration of conformity is issued under the sole responsibility of the provider identified in Section 2 above.
Annex V point 4 (Object of the declaration (identification of the product allowing traceability, which may include a photograph, where appropriate).): Northgate FlowMeter Agent software distribution package (npm package + signed release artifact), identified by the release tag stamped in this pack's header; traceable to its build via the CI pipeline run recorded for that release.
Annex V point 5 (A statement that the object of the declaration is in conformity with the relevant Union harmonisation legislation.): The product identified above is, to the best of the provider's knowledge, in conformity with Regulation (EU) 2024/2847 (Cyber Resilience Act) and no other Union harmonisation legislation applicable to this product category.
Annex V point 6 (References to any relevant harmonised standards used, or any other common specification or cybersecurity certification, in relation to which conformity is declared.): IEC 62443-4-2 was applied as the technical specification addressing the essential cybersecurity requirements, in the absence of a published harmonised standard for this product category (see Annex VII point 5 above).
Annex V point 7 (Where applicable, the name and number of the notified body, a description of the conformity assessment procedure performed, and identification of the certificate issued.): Not applicable — this product's conformity assessment procedure did not involve a notified body.
Annex V point 8 (Additional information: signed for and on behalf of (place and date of issue; name, function, signature).): Signed for and on behalf of Northgate Devices GmbH. Place: Mainz, Germany. Date of issue: date of pack generation, stamped in this pack's header. Name: Ilka Brandt. Function: Head of Product Compliance.
annex7.8 — Where applicable, the software bill of materials, further to a reasoned request from a market surveillance authority.
Derived
Regulation (EU) 2024/2847 (Cyber Resilience Act), consolidated text 02024R2847-20241120 (base act + Corrigenda 1-3, none of which touch Annex V, Annex VII, or Articles 13/31/33), Annex VII, point 8. See also BSI TR-03183-2 v2.1.0 section 4 (SBOM format: CycloneDX >=1.6 or SPDX >=3.0.1 required) and section 5.2.2 (required component fields, including licence information).
Scan evidence: packages.count: 2 package(s) identified via dependency scan
Scan evidence: packages.allLicensesKnown: all 2 resolved package(s) have a known license category