Legislation on cyber resilience This threatens companies through the Cyber Resilience Act of the EU

Related Vendor

Wuxi InfiMotion Technology Co., Ltd.

With the EU's Cyber Resilience Act (CRA), the industry is confronted with one of the strictest sets of rules. Everything containing a microchip will then be subject to strict obligations. Here are the details.

Manufacturers, importers, and dealers of products with digital elements, including anything containing a microchip, are obliged to a series of strict measures under the Cyber Resilience Act (CRA). However, there are currently few established processes for this, according to Onekey, a specialist in product cybersecurity. The Cyber Resilience Act will, among other things, require a cyber risk assessment before a product is even brought to market, as an example states. All manufacturers must start integrating the forthcoming requirements into product development now because developing new products and variations often takes many months or even years. Therefore, Onekey has presented the first compressed guide outlining the upcoming regulations, key measures, and practical advice for implementation for the industry.

Always have to be one step ahead of cyber criminals

In addition to security measures against unauthorized access, companies will also be obligated to software vulnerability and patch management in the future, as stated further. This should be done before any damage is caused by vulnerabilities that hackers could exploit. Essentially, developers must always stay one step ahead of hackers to ensure this. Throughout the entire product life cycle, manufacturers must effectively manage the vulnerabilities of their products, conduct regular tests, and demonstrate comprehensive patch management. Additionally, there is an obligation to maintain clear documentation.

This includes maintaining a Software Bill of Materials (SBOM), which details all software products— including hidden ones— contained in a device or system, as emphasized by Onekey. Depending on the product and components used, this could involve hundreds of different assemblies with their own microchips and accompanying hidden risks. Organizational structures must also be established to ensure that certain tasks and obligations under the CRA are carried out by a designated individual on behalf of the organization. This includes roles such as serving as the contact point for market surveillance authorities.