Cyber Resilience Act (CRA):
Build, Ship, and Maintain Secure Connected Devices
Explore the 4 steps of CRA Compliance
Step 1 - Scope, Requirements and deadlines
Who is in scope? (A Global Mandate)
The CRA applies to any “Product with Digital Elements” (PDE) placed on the EU market, regardless of where the manufacturer (OEM) is headquartered.
In practice, any device with a processor that connects to a network or another device. This covers everything from a simple sensor to an industrial gateway or a medical monitor.
For US & Global OEMs: Access to the EU market now requires a strategic shift. Unlike the US landscape—which relies largely on voluntary frameworks (e.g. NIST IR 8425, U.S. Cyber Trust Mark)—the CRA is a legally binding regulation. It also introduces mandatory vulnerability handling and post-market obligations, extending beyond initiatives such as Executive Order 14028.
Technical Classification (Annex III)
Default (majority of products):
Most products fall into this category and follow a self-assessment conformity process.
Important Products:
- Class I (Includes products such as identity management systems, browsers, and certain network-related components): these may be assessed without an external 3rd party by following an harmonized standard
- Class II (Includes high-impact components such as operating systems, hypervisors, and cryptographic infrastructure): these will require an external assessment by an authorized 3rd party
Critical products:
Smart cards, smart meters, HSMs: these require an external assessment following a suitable european cybersecurity scheme (a.k.a. EUCC)
The 15 Essential Technical Requirements (Annex I)
- Security by Default: Minimal attack surface and no generic default passwords.
- Access Control: Robust authentication and unauthorized access prevention.
- Confidentiality: Appropriate encryption for data at rest and in transit.
- Integrity: Mechanisms such as Secure Boot to prevent unauthorized code execution.
- Data Minimization: Processing only data necessary for the product’s intended purpose.
- Vulnerability Handling: Processes to identify, manage, and remediate vulnerabilities throughout the lifecycle.
- Secure Development & Delivery: Avoidance of known exploitable vulnerabilities at release.
- SBOM: Ability to provide a Software Bill of Materials (machine-readable where applicable).
- Updates: Capability to deliver security updates in a secure and reliable manner.
- Secure Decommissioning: Ability to securely erase or protect user data at end-of-life.
- Incident Reporting: Notification of actively exploited vulnerabilities and incidents to competent authorities within required timelines (e.g. initial notification within 24h).
- Availability & Resilience: Protect the availability of essential and basic functions, also after an incident, including through resilience and mitigation measures against denial-of-service attacks
- Network Protection: Minimise the negative impact by the products themselves or connected devices on the availability of services provided by other devices or networks
- Attack Surface Limitation: Be designed, developed and produced to limit attack surfaces, including external interfaces
- Security Monitoring: Provide security related information by recording and monitoring relevant internal activity, including the access to or modification of data, services or functions, with an opt-out mechanism for the user
The Timeline
CRA vs. RED: The Technical Shift
Many manufacturers are currently focused on the Radio Equipment Directive (RED) Article 3.3 (mandatory in 2025). While RED focuses on wireless interfaces, the CRA extends similar security principles to all products with digital elements. Note that from December 2027, the CRA will replace the cybersecurity requirements of the RED (the RED Delegated Act).
Meeting RED requirements is a strong starting point, but the CRA introduces broader and stricter obligations, particularly in areas such as vulnerability management, lifecycle security, and software transparency (e.g. SBOM).
The CRA Explained in 2 Minutes!
Explore
More Resources
Step 2 - Strategy & Risk Assessment
The CRA mandates a documented Cybersecurity Risk Assessment. At Witekio, we turn this legal requirement into a three-step engineering roadmap where we prioritize a pragmatic approach to help you reach compliance without stalling your R&D.
Attack Path Mapping
Countermeasure Impact
Defined Security Objectives
The Cyber Resilience Act – Avoid Penalties and Enhance Security
Step 3 - Security by Design
Architecture & Core Security
Validation & SBOM
Long-Term Support & OTA
Explore
More Resources
Step 4 - Long-Term Maintenance & CVE Management
The CRA requires manufacturers to provide security support for the full expected lifetime of their products, often several years after market launch. We offer you the infrastructure to meet these requirements.
Continuous monitoring
Hardware-specific triage
Patch delivery
Not sure where to start?
We transform your device vision into reality
4 countries
ISO 27001 certified
