Noticia

What is the Cyber Resilience Act (CRA)?

The Cyber Resilience Act (CRA), established under Regulation (EU) 2024/2847, is a European Union regulation that introduces mandatory cybersecurity requirements for products with digital elements, including software, applications, Internet of Things (IoT) devices, connected equipment, and other digital products placed on the European market.

Its main objective is to ensure that digital products are secure by design and remain secure throughout their entire lifecycle, reducing vulnerabilities and strengthening the protection of consumers, businesses, and public administrations against cyber threats.

Why is it important?

Digital products have become an essential part of everyday life. However, many devices and applications contain vulnerabilities that can be exploited by cybercriminals to compromise information, disrupt services, or endanger users' privacy.

The CRA addresses these challenges by establishing a common cybersecurity framework across the European Union, increasing trust in digital products and promoting a safer digital ecosystem.

Key requirements of the CRA

Among the main obligations introduced by the Regulation are:

Integrating cybersecurity by design and by default throughout the product development process.
Managing and remediating vulnerabilities throughout the entire product lifecycle.
Providing security updates in a timely manner.
Performing risk assessments before certain products are placed on the market.
Complying with mandatory reporting requirements for actively exploited vulnerabilities and severe cybersecurity incidents to the relevant authorities.
Providing users with clear information regarding product support and available security updates.

Implementation timeline

The Regulation establishes a phased implementation schedule:

10 December 2024: Regulation (EU) 2024/2847 entered into force.
11 September 2026: Obligations related to the reporting of actively exploited vulnerabilities and severe cybersecurity incidents become applicable.
11 December 2027: The main obligations of the Cyber Resilience Act become fully applicable.

Who is affected?

The Cyber Resilience Act primarily applies to:

Manufacturers of products with digital elements.
Software developers.
Importers and distributors of digital products.
Organizations placing technological products on the European Union market.

CSIRT-CAN Recommendation

CSIRT-CAN encourages organizations to stay informed about the implementation of this Regulation and begin assessing its potential impact. Adopting cybersecurity best practices, implementing continuous vulnerability management, and developing secure products will help strengthen digital resilience and reduce cyber risks.