The Cyber Resilience Act

What is the Cyber Resilience Act? When will it come into effect? What is the impact on your products and activities? What will you need to do to comply?
This synthesis aims at answering all device makers’ concerns and providing them with a clear path towards cybersecurity compliance.

What is the Cyber Resilience Act?

The Cyber Resilience Act (or “CRA”) is a regulation from the European Union to make sure equipment manufacturers develop and maintain secure hardware and software products.

Who must comply with this regulation?

This regulation applies to all products with digital elements with a direct or indirect logical or physical data connection to a device or network.

Product categories: default, important & critical

The Cyber Resilience Act classifies products in three categories with distinct security requirements to meet.

Key activities to comply with the Cyber Resilience Act

Cybersecurity risk assessment

The CRA requires equipment manufacturers to do comprehensive security assessments of their products and share them in products technical documentations.

Secure by design development

“On the basis of the cybersecurity risk assessment and where applicable, products with digital elements shall be made available on the market without known exploitable vulnerabilities”

Vulnerability monitoring & patching during the product lifecycle

Device makers are required by the Cyber Resilience Act to diligently manage and address security vulnerabilities in their products.

Documentation

Product technical documentation will serve as a vector of information on security activities for verification authorities and end-customers.

Reporting

Equipment manufacturers must establish clear protocols for reporting cybersecurity incidents, both internally and to relevant stakeholders.

Conformity assessment

Before launching a new product, device makers must conduct an assessment to validate that it doesn’t present any known and exploitable vulnerability.

When will the CRA be effective? Cyber Resilience Act timeline

To let OEMs the time to adapt to the new regulation, equipment manufacturers have 36 months from the regulation entry into force (December 11th, 2024) to organize themselves, except for reporting obligations regarding actively exploited vulnerabilities and incidents, which should apply 21 months from its entry into force.