EBV_12 Expert Tips CRA

EU Cyber
Resilience Act
12 EXPERT TIPS FOR TODAYS
PRODUCT DEVELOPMENT
1
Key Insights from our
Expert Panel Discussion
The following 12 tips are the outcome
of our recent panel discussion, “Practical
Impacts of the Cyber Resilience Act (CRA)
on Product Development,” with leading
industry experts. It highlights critical
requirements for product development
under the CRA, offering essential con-
siderations to help ensure connected
products are secure from design through
to deployment.
2
Our Experts
Julien Bernet,
Security Manager, Witekio
“ The CRA applies to essentially all

connected products. Any product,
even non-critical ones, could poten-
tially be used as an attack vector for
”
critical infrastructure.
Jaques Kruse Brandao,

Global Head of Advocacy,
TÜV Informationstechnik
GmbH – TÜVIT
“ Manufacturers will need to imple-

ment secure development lifecycles
and key management processes.
Once these systems are in place, they
can be used for every new product.
The initial setup may be costly, but the
”
long-term benefit is significant.
3
Daniel Bartz,
FAE Security & Identifica-
tion, EBV Elektronik GmbH
“ The CRA mandates ongoing

vulnerability monitoring and patching
throughout the product’s lifecycle.
This ongoing responsibility is
something entirely new compared
to previous standards.
”
Dr.-Ing. Steven Arzt,
Head of Secure Software
Engineering department,
The Fraunhofer Institute
for Secure Information
Technology (SIT)
“ Companies need to carefully

select open-source projects. If you
choose a project that is outdated or
no longer maintained, you might end
up being liable for maintaining that
”
code as if it were your own.
4
Strengthening Cyber-
security Across Europe
The Cyber Resilience Act represents a
landmark effort to bolster cybersecurity
across Europe, applying to all con
nected products, including critical com
ponents within the All Electric Society.
With cyberattacks on energy utilities
doubling between 2020 and 2022, the
urgency for robust cyber protection has
never been higher. Recent incidents –
such as the hacking of wind farms and
breaches in electricity meter systems –
underscore the vulnerabilities present
in modern power infrastructures, which
impact sensitive customer data and
essential services. The International En-
ergy Agency reports that the energy
sector alone saw an average data breach
cost of 4.72 million US dollars in 2022,
highlighting the financial stakes of these
security threats.
5
EMBEDDING SECURITY FROM
THE START
To address these challenges, the CRA
mandates manufacturers to prioritize
security from the earliest stages of
product design. “The need for cyber
security affects the entire power grid,
from distribution networks to renewable
energy sources,” says Frances Cleveland,
Head of the International Electrotech
nical Commission’s (IEC) Cybersecurity
Committee, emphasizing the impor-
tance of “secure by design” principles.
This approach, detailed in standards
like IEC 62351, ensures that products
are equipped with cybersecurity
protections from the outset, rather
than as retrofits.
RISK-BASED COMPLIANCE FOR

A CYBER-RESILIENT FUTURE
Expected to take full effect by 2027,
the CRA requires that all connected
products meet baseline cybersecurity
6
requirements to receive CE marking
for sale in the EU. The Act introduces a
risk-based approach, differentiating
products by criticality, with high-risk
products facing more stringent asses
sments. Manufacturers will have
36 months to comply, ensuring they
implement robust security practices
and maintain them throughout the
product lifecycle. The CRA’s stringent
standards aim to reduce vulnerabilities
across both hardware and software,
creating a safer and more resilient Europe.
7
12 Tips to Consider as
Manufacturer
1.
APPLICABILITY TO ALL CONNECTED

PRODUCTS
The CRA covers all connected products,
even those using communication pro
tocols like Bluetooth or NFC. It requires
compliance even if the device isn’t
currently internet-connected, as it may
become part of a connected ecosys-
tem later.
OUR TIP
Even if your product isn’t inter-
net-connected today, design
with future connectivity in mind
to avoid costly redesigns later.
8
Manufacturer
2.
PRODUCT CLASSIFICATION AND

CERTIFICATION
The CRA divides products into critical
and important categories, with
critical products requiring high-level
certification and important products
needing third-party evaluation. Manu
facturers must determine their
product category to plan certification.
OUR TIP
Identify early which product cat-
egory (critical or important) your
product falls into and plan certi
fication processes accordingly to
avoid delays in market entry.
9
Manufacturer
3.
SUPPLY CHAIN ACCOUNTABILITY

Manufacturers are responsible for
ensuring that all components, including
third-party and open-source software,
comply with the CRA. This requires
regular monitoring and patching of
vulnerabilities throughout the product’s
lifecycle.
OUR TIP
When using third-party compo-
nents or open-source software,
demand security documentation
and updates from your suppliers
to streamline CRA compliance.
10
Manufacturer
4.
IMPACT ON SMALL AND MEDIUM

ENTERPRISES (SMES)
SMEs may struggle with the additional
resources needed for CRA compliance,
including risk assessments and product
certifications. Outsourcing to third-
party evaluators can help manage this
burden.
OUR TIP
Consider outsourcing compliance
tasks to specialized third-party
cybersecurity auditors to manage
the burden of CRA without having
to build an in-house team.
11
Manufacturer
5.
RESPONSIBILITY FOR INTENDED

USE AND MISUSE
Manufacturers are responsible for
specifying how their products should
be used. If a product is misused and
causes a security issue, the manufac-
turer may still bear some liability.
OUR TIP
Provide clear user guides and
disclaimers on how your product is
intended to be used to minimize
liability for misuse under the CRA.
12
Manufacturer
6.
SOFTWARE BILL OF MATERIALS

(SBOM) COMPLIANCE
Manufacturers must provide a Software
Bill of Materials (SBOM) detailing all
software components in their products.
The SBOM needs to be in a machine-
readable format and updated through-
out the product’s lifecycle.
OUR TIP
Start building your SBOM now, using
formats like Cyclone DX or SPDX,
and automate the process of
updating it with each new product
version.
13
Manufacturer
7.
VULNERABILITY MANAGEMENT
The CRA requires manufacturers to
report vulnerabilities within 24 hours and
provide ongoing updates until a fix is
available. Manufacturers must also pro-
vide customers with interim solutions
to mitigate risks if a full fix is not imme-
diately available.
OUR TIP
Establish a vulnerability response
process now, including a system
for immediate reporting and cus-
tomer communication to ensure
compliance with CRA timelines.
14
Manufacturer
8.
COMPLIANCE TIMELINE
The CRA provides a 36-month transition
period, during which existing products
can continue to be sold. However, by the
end of the grace period, all products
must be fully CRA-compliant.
OUR TIP
Begin CRA compliance prepara-
tion early by auditing your current
products and identifying any gaps
that will need to be addressed
within the 36-month window.
15
Manufacturer
9.
IMPACT ON PRODUCT DESIGN

Products may need redesigns to meet
CRA requirements, including secure
elements for storing encryption keys
and secure development processes.
OUR TIP
Focus on secure design from the
start, incorporating secure ele
ments (like hardware security
modules) and encryption key
management to streamline future
compliance.
16
Manufacturer
10.
CERTIFICATION AND STANDARDS

While certification processes are still
being finalized, manufacturers can
begin by following established stand-
ards like EN 303645 for IoT consumer
products and looking into available
certification schemes like EUCC.
OUR TIP
Start aligning your product design
and testing with existing standards
such as EN 303645 and consider
early certification through exist-
ing schemes to ensure a smoother
CRA transition.
17
Manufacturer
11.
ADDRESSING LEGACY SYSTEMS

For industries using legacy systems,
products may need secure integration
with connected devices. While legacy
machines remain unchanged, con
nected components must meet CRA
standards, especially regarding secure
default settings.
OUR TIP
Plan for secure integration of legacy
systems with connected devices
by updating IoT components to
meet CRA compliance while main-
taining core legacy operations.
18
Manufacturer
12.
ONGOING LIFECYCLE MANAGEMENT

The CRA mandates ongoing product
support, including vulnerability monitor-
ing and security updates, for the life
cycle of the product. The suggested
guideline is five years, but this may ex-
tend for longer-lived products.
OUR TIP
Set up processes for continuous
monitoring and patching, ensuring
your product’s cybersecurity
remains compliant throughout
its entire lifecycle, especially for
long-lived industrial products.
19
For tailored guidance
on implementing
the Cyber Resilience
Act in your product
development, contact
EBV Elektronik today.
GET IN TOUCH
20

EBV_12 Expert Tips CRA

Uploaded by

Copyright:

Available Formats

EBV_12 Expert Tips CRA

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

EBV_12 Expert Tips CRA

Uploaded by

Copyright:

Available Formats

EU Cyber

“ The CRA applies to essentially all

Jaques Kruse Brandao,

“ Manufacturers will need to imple-

“ The CRA mandates ongoing

“ Companies need to carefully

RISK-BASED COMPLIANCE FOR

APPLICABILITY TO ALL CONNECTED

PRODUCT CLASSIFICATION AND

SUPPLY CHAIN ACCOUNTABILITY

IMPACT ON SMALL AND MEDIUM

RESPONSIBILITY FOR INTENDED

SOFTWARE BILL OF MATERIALS

IMPACT ON PRODUCT DESIGN

CERTIFICATION AND STANDARDS

ADDRESSING LEGACY SYSTEMS

ONGOING LIFECYCLE MANAGEMENT

You might also like