CRA What You Should Know About the EU Cyber Resilience Act

Related Vendors

secunet Security Networks AG

FAULHABER Drive Systems

Taiwan Machine Tool & Accessory Builders' Association (TMBA)

Wuxi InfiMotion Technology Co., Ltd.

The Cyber Resilience Act is intended to protect against products with inadequate IT security functions. The requirements affect the entire life cycle. But what does this mean in concrete terms and which companies are affected?

Dr.-Ing. Rodrigo do Carmo is Head of Manufacturing & Information Security at secunet.

The Cyber Resilience Act (CRA) complements the EU cybersecurity strategy by creating the technical basis for secure products and thus making a significant contribution to the security of the internal market. It is primarily aimed at manufacturers, but also contains obligations for importers and distributors with regard to the further marketing of products in the supply chain. The CRA aims to increase the cybersecurity level of hardware and software and protect users from harm.

Whether Small And Medium-Sized Enterprises or Large Corporations: the CRA Applies To All

Whether laptops, smartwatches or networked machines: with a few exceptions, the CRA regulates all products with digital components. In addition to software and hardware products, their solutions for the remote processing of data required for functionality are also affected. This includes all products that process or exchange data. The CRA will therefore also be part of the CE marking that every product must have when it is launched on the market.

This poses technical challenges, particularly in terms of production and maintenance, which can be financially and operationally demanding, especially for small and medium-sized enterprises. CRA-compliant products must contain technical components such as embedded hardware security modules that ensure secure encryption and data integrity protection. The same applies to the exchange of certificates to verify the authenticity of users or entities for which a public key infrastructure is required. Depending on the maturity of the implementation and the risk assessment of the product, companies must provide different budgets for the improvement or implementation of cyber security requirements.

Security Categories And Control: Action Protects Against Penalties

The CRA guarantees compliance with the new requirements through various control mechanisms and sanctions. Manufacturers must prove the conformity of their products through specific procedures, which are divided into different safety categories depending on the type of product and the respective process requirements:

• "Basic category" applies to all products with digital components.

• "Important products" can be Class I security-related products such as password managers, browsers or systems for the management of security information and events (SIEM) or Class II products with security components such as firewalls, intrusion detection systems and intrusion prevention systems and hypervisors (basic operating systems of virtualized cloud platforms).

• "Critical products" are smart meter gateways in smart metering systems, hardware devices with security boxes and smart cards, where security is considered a central feature of the entire product.

Whether companies have to carry out the conformity assessment procedure themselves or involve an external body depends on the respective product category. However, if the implementation of the requirements is not or only insufficiently fulfilled, high fines may be imposed. These can amount to several million euros or up to 2.5 percent of the global turnover of the previous financial year.

Cybersecurity for Greater Resilience: What Companies Should Do Now

To protect their business, companies should act now and make cyber security an integral part of their strategy. To begin with, a GAP analysis is recommended to understand the gaps between the status quo and the requirements of the CRA. Once the weak points have been identified, risks can be assessed and specific measures derived

Established standards and guidelines can provide guidance. Technical standards such as the IEC 62443 family or ISO/IEC 27001 support the introduction of systematic approaches to securing IT and OT systems. EU regulatory frameworks, including the NIS 2 Directive, the RED Directive (Radio Equipment Directive), the General Data Protection Regulation (GDPR) and the new EU Machinery Regulation (MVO), which will come into force in January 2027, provide additional specifications and requirements. Core elements of information security such as risk and vulnerability management are also crucial for a holistic cyber security strategy.

Even if it initially requires capacity and effort, the CRA is an opportunity for companies to become more resilient. And since the CRA was adopted in October 2024, the clock has been ticking: all requirements must be implemented in various stages by December 2027. If companies consider cyber security in all processes from the outset, this can give them a competitive advantage.

Smart-Factory

Access solutions for the Smart Factory - Industry 4.0