An educational tool that produces a PRD-ready requirements document tailored to your product's deployment context. You pick the archetype and markets; the tool resolves which regulatory frameworks apply and generates requirements cited to those standards.
Not a compliance deliverable. This tool is for orientation and sprint planning. A formal requirements baseline still needs qualified engineering review and the authoritative texts.
Take Amazon's Ring Video Doorbell: a camera and microphone at the front door, paired to the Ring app, with clips stored in Ring's cloud. It sells in the United States, the United Kingdom and across the EU. Here is what the generator produces for it, screen by screen.
Archetype 2, embedded device + cloud service. The doorbell cannot do its job without Ring's servers and the app is a thin client. Environment: home / residential. That pairing selects the consumer requirement bank.
| Target markets | EU, UK, US |
|---|---|
| Connectivity | Wi-Fi, Bluetooth (setup) |
| Data handled | Video / audio, PII (account, address), usage telemetry |
| Price point | $25 – $100 |
The resolver returns five frameworks: ETSI EN 303 645 (the EU and the UK both align with it), the EU Cyber Resilience Act, GDPR (the doorbell records the faces and voices of people who never installed the app), the UK PSTI Act, and the US Cyber Trust Mark, which is voluntary and labelled as such. Nothing industrial fires, because the environment is a home.
Twenty-seven requirements, grouped by lifecycle stage: 7 at concept and design, 6 in manufacturing, 6 at deployment, 8 post-market. Four of them exist only because of the profile you entered:
Every line carries the clause it comes from: PSTI Schedule 1 paragraph 1 for unique per-device credentials, CRA Annex I Part I 2(c) for the secure update mechanism, GDPR Article 17 for user data deletion. The export (Markdown or CSV) keeps those citations, so whoever reviews the PRD can check each one against the authoritative text.
A list of security requirements grouped into four lifecycle stages: concept and design, manufacturing, deployment, and post-market. Each requirement names an owner, a priority (mandatory or recommended), an effort and impact rating, and the standard and clause it derives from. You can export the list as Markdown for a PRD or as CSV for a tracker.
ETSI EN 303 645, the EU Cyber Resilience Act, the UK PSTI Act and GDPR for consumer products; IEC 62443-4-2 and NIS2 when the environment is industrial; CIS Controls v8 for appliances built on a general-purpose OS. A standard is cited only when your archetype, environment or markets bring it into scope.
The generator is for products you have not built yet: it writes requirements. The scorecard is for products that exist: it grades them. Both resolve the same regulatory scope from the same archetype and market inputs, so a product specified with the generator should score well on the scorecard.
No. It is an educational planning tool. Use it to get the security section of a PRD to a first draft in an afternoon, then have that draft reviewed against the authoritative texts by someone qualified to sign off.
Yes. Choose the industrial / OT environment and the tool adds an OT supplement citing IEC 62443-4-2, plus NIS2 obligations if the EU is a market. A gateway deployed in an industrial setting is escalated to the composite bank, because its management layer behaves like a general-purpose computer.