CRA (Cyber Resilience Act) Guide: how to achieve compliance?

What is the Cyber Resilience Act?

The CRA is the first European regulation to establish horizontal cybersecurity requirements for digital products placed on the EU market. It aims to put an end to two major issues: products that are vulnerable by design, and the absence of security updates once a product has been sold.

It is built on essential cybersecurity requirements, a conformity assessment (self-assessment or third-party depending on criticality), technical documentation and CE marking, as well as ongoing vulnerability management and notification obligations.

It interfaces with NIS2 (organisational security) and the Cybersecurity Act (certification): where NIS2 targets entities, the CRA targets the products themselves.

Who is affected?

The CRA targets the entire market supply chain for digital products. The manufacturer role carries the bulk of the obligations, but importers and distributors also have verification duties.

• Manufacturers of software and connected hardware: primary role, heaviest obligations.
• Importers and distributors: required to verify the compliance of the products they make available.
• SaaS publishers when their products fall within the scope of digital elements.
• "Critical" and "important" products subject to enhanced assessment requirements.

The application timeline

The CRA applies in stages. Notification obligations come into effect before full enforcement, leaving little time to prepare development cycles that are often lengthy.

Verify the exact deadline applicable to your product category before any market-placement decision.

What are the concrete obligations?

The obligations cover the entire product lifecycle, from design through to the end of the support period.

• Integrate security by design and by default.
• Supply products free of known exploitable vulnerabilities at the time of placing on the market.
• Provide security updates throughout the entire support period.
• Establish technical documentation and an EU declaration of conformity.
• Affix the CE marking covering cybersecurity.
• Maintain an SBOM (software bill of materials) and a coordinated vulnerability disclosure process.
• Notify actively exploited vulnerabilities and significant incidents to the authorities.

What penalties apply in the event of non-compliance?

The CRA provides for substantial fines calibrated to the severity of the infringement, as well as market surveillance measures that may include product withdrawal.

How to achieve compliance: the 7-step roadmap

Step 1 — Inventory your digital products

Identify all your products with digital elements and determine which fall within the scope of the CRA and their criticality class (default, important, critical).

Do not overlook third-party and open-source components integrated into your product: they are part of your product and your obligations.

• Include firmware, third-party components, and open-source dependencies.
• Determine the criticality class of each product.
• Identify the support period for each one.

Step 2 — Integrate security by design

Adopt a "secure by design/by default" approach: attack surface reduction, access management, encryption, hardening of default configurations, and security testing integrated into the development cycle.

These principles must be embedded upstream: retrofitting them afterwards is far more costly and delays time to market.

• Reduce the attack surface and harden defaults.
• Integrate security testing into the development pipeline.
• Secure access management and encryption.

Step 3 — Establish vulnerability management and the SBOM

Implement monitoring, a remediation process, and coordinated vulnerability disclosure, supported by an up-to-date SBOM (Software Bill of Materials) that lists all components.

The SBOM is essential: without it, you cannot quickly determine whether a newly discovered vulnerability affects your products.

• Maintain an up-to-date SBOM for each product.
• Establish a point of contact and a disclosure policy.
• Prioritise and remediate vulnerabilities according to their severity.

Step 4 — Build the technical documentation

Draft the required documentation, the product cyber risk assessment, and the EU declaration of conformity that underpin CE marking.

This documentation must be kept up to date throughout the entire life of the product.

• Document the product cyber risk assessment.
• Draft the EU declaration of conformity.
• Keep the documentation current over time.

Step 5 — Carry out the conformity assessment

Depending on the product class, conduct a self-assessment or a third-party assessment, then affix the CE marking covering cybersecurity.

Plan ahead: for critical products, involvement of a notified body can extend timelines.

• Determine the assessment route based on the product class.
• Involve a third-party body where required.
• Affix CE marking once conformity has been established.

Step 6 — Organise incident notification

Prepare procedures to notify, within the required timeframes, actively exploited vulnerabilities and serious incidents to the competent authorities (ENISA and national authorities).

These timeframes are short: the decision-making chain must be defined in advance.

• Define the detection and notification workflow.
• Prepare reporting templates.
• Test the procedure through exercises.

Step 7 — Sustain compliance over time

Deliver security updates, keep the documentation and SBOM current, and monitor vulnerabilities throughout the entire announced support period.

CRA compliance does not end at market placement: it remains active for as long as the product is supported.

• Issue security updates throughout the entire support period.
• Update the SBOM and documentation with every change.
• Continuously monitor component vulnerabilities.

Common mistakes to avoid

• Waiting until 2027 to get started, when security by design is built over long development cycles.
• Ignoring open source and third-party components, which are nonetheless covered by the obligations.
• Failing to plan for a support period and security updates.
• Neglecting the coordinated vulnerability disclosure process.
• Not maintaining an SBOM, which makes vulnerability management unmanageable.
• Underestimating assessment timelines for critical products.

How Data Comply One supports you

Data Comply One helps publishers and manufacturers structure their CRA compliance: cyber risk analysis, document management, vulnerability and SBOM tracking, and alignment with your other obligations (NIS2, ISO 27001, Cybersecurity Act).

Two modes are available to you: manage your compliance yourself using the software, or outsource it to our experts — an outsourced CISO — who manage security by design and vulnerability management and disclosure processes on your behalf, directly on the platform, for a smooth and compliant market launch.

You thus transform a regulatory requirement into a commercial asset: a product whose security is demonstrable reassures your customers and sets you apart from the competition.

This dedicated module is coming soon to the platform: request a demo to try it out ahead of its release.

Where do you stand? ·