CRA compliance
A first ever EU wide legislation of its kind: the Cyber Resilience Act introduces mandatory cybersecurity requirements for hardware and software products, throughout their whole lifecycle.
Vulnerability Management
Effective vulnerability management requires a systematic approach to identifying, assessing, prioritizing, mitigating, and monitoring security vulnerabilities in order to minimize the risk and impact of potential breaches.
The latest regulatory requirements include:
- Documenting product vulnerabilities throughout the lifecycle.
- Promptly addressing and remediating identified vulnerabilities.
- Conducting regular and effective testing, assessments, and reviews.
- Publishing vulnerability and patch information in accordance with coordinated disclosure policies.
- Reporting vulnerabilities within a three-phase process:
- Initial report within 24 hours of detection.
- Intermediate report with expanded information within 72 hours.
- Final report within 14 days of the incident, including full analysis of the threat, identified malicious actors, and corrective/security measures taken.
- Reporting must be submitted to ENISA or to a CSIRT (Computer Security Incident Response Team) designated by the relevant Member State.
- Providing security updates promptly and free of charge for at least five years.
- Maintaining cybersecurity-related technical documentation (e.g., design specifications, architecture, risk assessments) for at least 10 years after product placement on the market, or for the entire support period of the product, whichever is longer.
Non-compliance with these requirements can result in penalties of up to €15 million.
Product Conformity
Product compliance is crucial to ensure that IT products meet the quality, safety and performance standards required for effective and safe use in business and consumer environments. These will be the new requirements applied:
- Design, develop, and produce the product with an adequate level of cybersecurity, and with default security policies.
- Evaluate and document all cybersecurity risks.
- Include cybersecurity assessment in the technical documentation.
- Systematically document relevant cybersecurity aspects.
Consider changes in the development, production, and design process that may impact cybersecurity.