Cyber Resilience Act Consulting

The Cyber Resilience Act (CRA, EU 2024/2847) is the first EU-wide product safety regulation to set explicit cybersecurity requirements for hardware and software with network functionality. Affected parties include manufacturers, importers, and distributors of products with digital elements: connected devices, software, IoT products, industrial control systems, routers, smart home devices, and – with specific limitations – software-as-a-service components integrated directly into products.

The CRA categorises products by risk level. Standard products (Class I) are subject to a simplified conformity assessment. Critical products (Class II) – including network devices, firewalls, industrial routers, and certain operating systems – require assessment by a notified body. Highly critical products require the most stringent evaluation. Correctly classifying your products is the first and most important step.

The transition deadlines are clear: from September 2026, manufacturers must implement the vulnerability reporting obligations; from December 2027, the full requirements apply. Organisations that ignore these deadlines risk losing market access in the EU single market, recalls, and significant fines. For export-oriented manufacturers, CRA compliance is not a regulatory option but a business prerequisite.

The CRA enshrines security-by-design as a binding principle. Manufacturers must consider security from the first design decision – not as an afterthought at patch level, but as an integral part of the development process. This includes structured threat modelling, secure coding practices, code reviews, and automated security tests as part of the CI/CD pipeline.

One of the concrete CRA requirements is vulnerability management across the entire product lifecycle. Manufacturers must actively report actively exploited vulnerabilities in their products to ENISA (EU Agency for Cybersecurity) within 24 hours of becoming aware of them – and begin remediation immediately. This requires manufacturers to systematically monitor which vulnerabilities arise in their products and their dependencies.

Security updates must be provided free of charge for the entire expected product lifespan. The CRA defines minimum support periods depending on product category – a significant challenge for many IoT manufacturers whose existing business models relied on end-of-support as a driver for new device purchases.

A Software Bill of Materials (SBOM) is a machine-readable inventory of all software components in a product – libraries, frameworks, runtime environments, dependencies. The CRA requires manufacturers to create and maintain an SBOM for their products to enable identification of known vulnerabilities in the components used.

The relevant SBOM formats are SPDX (ISO/IEC 5962:2021) and CycloneDX – both open standards supported by common build systems and CI/CD platforms. The real challenge is not generating an SBOM but continuously matching it against public vulnerability databases (NVD, OSV, GHSA) and integrating the results into an actionable vulnerability management process.

We integrate SBOM generation and vulnerability monitoring into your existing development pipeline: automated SBOM creation as a build step, continuous matching against current vulnerability data, alerting on new CVEs with CVSS prioritisation, and a documented process for risk decisions and remediation. This creates not only CRA compliance but real security value.