The European Union’s (EU) Cyber Resilience Act (CRA) is the first EU-wide law establishing mandatory cybersecurity requirements for hardware and software products with digital elements and spanning their complete lifecycles.
Designated as EU Regulation 2024/2847, CRA places responsibility for cybersecurity on suppliers, importers, distributors and their data-support providers seeking to sell these products in the EU, instead of leaving cybersecurity up to users as is done elsewhere. This means products must comply with requirements in CRA’s Annex I, and suppliers must perform other related obligations.
Compliance is shownical CE marking on each product. In general Annex I’s obligations consist of capabilities compliant products must possess and activities suppliers manufacturer must perform. More specifically, products must be:
- Secure by design and default, and delivered with a secure configuration and a minimized attack surface.
- Free of any known exploitable vulnerabilities, and shipped with no known, exploitable flaws.
- Use a vulnerability-handling process to identify, document, remediate and disclose issues.
- Perform free, timely security updates throughout defined support periods, including five years by default, though shorter when a product’s expected use is shorter, and longer when it’s longer.
- Maintain a software bill of materials (SBOM) covering a product’s components in a commonly used, machine-readable format.
- Report about actively exploited vulnerabilities and severe incidents to EU cybersecurity agency ENISA and the relevant computer security incident response team (CSIRT) with an early warning within 24 hours.
While CRA is already in effect, its obligations are phasing in this year. For example, mandatory reporting became applicable this past September, core, harmonized standards are due on Dec. 31, and most provisions take full effect in Dec. 11, 2027.
“From an end-user perspective, CRA is a net positive. Whether an automation solutions provider has, like Emerson, offered secure development processes and IEC 62443-4-1 compliance for many years, or is less advanced in its cybersecurity offerings, CRA lets users get better transparency from suppliers on issues and stronger timelines for when those issues need to be resolved,” says Matthew Kane, cybersecurity product and program leader at Emerson. “CRA also increases pressure on suppliers to help support cybersecurity across the lifecycle journey, which reduces risks that users will be stranded with no support if a technology is retired prematurely.”
Kane report that EU’s Network and Information Security 2 (NIS2) directives and CRA regulations are risk-based, and work together to define not only roles and responsibilities, but also what security tools and techniques should be available, and how actively exploited vulnerabilities should be reported.
“This is what’s driving most of the effort. What’s also interesting to notice is how other countries and world areas—like Saudi Arabia and India—are coming up with their own regulation requirements,” adds Kane. “For instance, regional standards and regulations are increasingly referencing cybersecurity standards like IEC 62443, so CRA is also likely to be beneficial worldwide.”
