Cyber Resilience in the Spotlight: What, for Whom, Why, and When?

Access to the EU market will soon require more than just CE marking. Do you know what will be required from you?

What is the CRA?

The Cyber Resilience Act (CRA) establishes common minimum cybersecurity requirements and standards for products with digital elements, including hardware, software, and data remote processing solutions available on the EU market. Its objective is to improve the digital security of products and reduce their vulnerabilities, thereby building trust and creating added value for product users.

Compliance with the requirements set out in the CRA will raise the level of cybersecurity in many products and across the entire supply chain. In addition, the regulation requires products and software to receive up to date security updates. It also introduces manufacturers’ duty of care and incident reporting obligations.

The three key pillars of cyber resilience are:

• risk management
• incident response and recovery
• business continuity

The CRA will become a mandatory part of the CE marking requirements for placing products on the European market.

Who does the CRA apply to?

The Cyber Resilience Act applies to many companies that place new or updated digital products on the European market, including manufacturers, software developers, distributors, and importers.
It is important to understand that, unlike NIS2 or DORA, which regulate the network and information systems of critical entities, the CRA regulates products.

We trust that a company storing sensitive or highly sought after assets—such as a bank—is subject to strict regulation. Until now, however, the same level of data protection has not been expected from products such as smartwatches or baby monitors. Today, users want to be confident that an IoT product cannot be hacked.

Compliance with the essential CRA requirements creates added value for the product, as users of a compliant device can trust its security and understand the risks associated with its use.
By improving the security of products with digital elements, the CRA strengthens the digital resilience of all users—and consequently the entire European ecosystem.

Product categories under the CRA

The Cyber Resilience Act defines four categories of regulated products:

1. Default category
2. Important products – Class I
3. Important products – Class II
4. Critical products

The classification determines the required conformity assessment procedure for each product. The more critical the product, the more stringent the conformity assessment.
Independent third party assessment and approval are required for the following product categories:

Important products – Class II:

1. Hypervisors
2. Firewalls, intrusion detection and prevention systems
3. Tamper resistant microprocessors
4. Tamper resistant microcontrollers

Critical products:

1. Devices incorporating security chips
2. Smart meter gateways
3. Smart cards or similar devices, including secure elements