CRA Isn't New. OT Just Wasn't Listening.
The EU Cyber Resilience Act is panicking the OT world. Mission-critical software has shipped under stricter rules for thirty years. The standards aren't the problem. The architecture is.
Cybersecurity
Company as Code: You Don't Need a New DSL
Sphinx-needs already provides the primitives for encoding company structure, policies, and compliance as code. You just haven't pointed it at that domain yet.