Cyber Resilience Act Consulting

The Cyber Resilience Act (CRA, EU 2024/2847) is the first EU-wide product safety regulation to set explicit cybersecurity requirements for hardware and software with network functionality. Affected parties include manufacturers, importers, and distributors of products with digital elements: connected devices, software, IoT products, industrial control systems, routers, smart home devices, and – with specific limitations – software-as-a-service components integrated directly into products.

The CRA categorises products by risk level. The majority of products fall into the default category and can be self-assessed by the manufacturer. Important products in Class I (Annex III) – such as password managers, browsers, VPNs, operating systems, routers and switches – can also be self-assessed where harmonised standards are fully applied; otherwise a notified body must be involved. Important products in Class II (Annex III) – including firewalls, intrusion detection/prevention systems, hypervisors and tamper-resistant microprocessors/microcontrollers – always require a notified body. Critical products (Annex IV) – such as hardware security modules, smart meter gateways and smartcards/secure elements – are subject to the most stringent evaluation, potentially via an EU certification scheme. Correctly classifying your products is the first and most important step.

The transition deadlines are clear: from September 2026, manufacturers must implement the vulnerability reporting obligations; from December 2027, the full requirements apply. Organisations that ignore these deadlines risk losing market access in the EU single market, recalls, and significant fines. For export-oriented manufacturers, CRA compliance is not a regulatory option but a business prerequisite.

The CRA enshrines security-by-design as a binding principle. Manufacturers must consider security from the first design decision – not as an afterthought at patch level, but as an integral part of the development process. This includes structured threat modelling, secure coding practices, code reviews, and automated security tests as part of the CI/CD pipeline.

One of the concrete CRA requirements is vulnerability management across the entire product lifecycle. Manufacturers must report actively exploited vulnerabilities in their products via the single reporting platform to the relevant CSIRT and ENISA (EU Agency for Cybersecurity) within 24 hours of becoming aware of them (early warning) – and begin remediation immediately. This requires manufacturers to systematically monitor which vulnerabilities arise in their products and their dependencies.

Security updates must be provided across the support period, which must reflect the expected product lifespan and is generally at least five years (unless the product is used for a shorter time). The Commission may specify fixed minimum periods per product category in future – a significant challenge for many IoT manufacturers whose existing business models relied on end-of-support as a driver for new device purchases.

A Software Bill of Materials (SBOM) is a machine-readable inventory of all software components in a product – libraries, frameworks, runtime environments, dependencies. The CRA requires manufacturers to create and maintain an SBOM for their products to enable identification of known vulnerabilities in the components used.

The relevant SBOM formats are SPDX (ISO/IEC 5962:2021) and CycloneDX – both open standards supported by common build systems and CI/CD platforms. The real challenge is not generating an SBOM but continuously matching it against public vulnerability databases (NVD, OSV, GHSA) and integrating the results into an actionable vulnerability management process.

We integrate SBOM generation and vulnerability monitoring into your existing development pipeline: automated SBOM creation as a build step, continuous matching against current vulnerability data, alerting on new CVEs with CVSS prioritisation, and a documented process for risk decisions and remediation. This creates not only CRA compliance but real security value.