The Cyber Resilience Act
What is the Cyber Resilience Act? When will it come into effect? What is the impact on your products and activities? What will you need to do to comply?
This synthesis aims at answering all device makers’ concerns and providing them with a clear path towards cybersecurity compliance.
What is the Cyber Resilience Act?
The Cyber Resilience Act (or “CRA”) is a regulation from the European Union to make sure equipment manufacturers develop and maintain secure hardware and software products.
Who must comply with this regulation?
This regulation applies to all products with digital elements with a direct or indirect logical or physical data connection to a device or network.
Product categories: default, important & critical
The Cyber Resilience Act classifies products in three categories with distinct security requirements to meet.
The Cyber Resilience Act deadlines are closer than you think
CRA deadlines are approaching very quickly: Reporting obligations regarding actively exploited vulnerabilities and incidents will begin in September 2026, while all other obligations will enter into force in December 2027.
Risks of non-compliance
Key activities to comply with the Cyber Resilience Act
Cybersecurity risk assessment
The CRA requires equipment manufacturers to do comprehensive security assessments of their products and share them in products technical documentations.
Secure by design development
“On the basis of the cybersecurity risk assessment and where applicable, products with digital elements shall be made available on the market without known exploitable vulnerabilities”
Vulnerability monitoring & patching
Device makers are required by the Cyber Resilience Act to diligently manage and address security vulnerabilities in their products.
Documentation
Product technical documentation will serve as a vector of information on security activities for verification authorities and end-customers.
Reporting
Equipment manufacturers must establish clear protocols for reporting cybersecurity incidents, both internally and to relevant stakeholders.
Conformity assessment
Before launching a new product, device makers must conduct an assessment to validate that it doesn’t present any known and exploitable vulnerability.
Our off-the-shelf solutions to comply with the Cyber Resilience Act
The simplest path for accurate vulnerability monitoring & reporting
Deploy secure updates for IoT devices fleet quickly & simply.
A CRA-compliant & production ready foundation for your Linux devices.
