The Cyber Resilience Act (CRA) introduces mandatory cybersecurity requirements for a wide range of software and hardware products.

 

For businesses, two key questions arise: Who does the CRA apply to, and what needs to be done by the end of 2027 to comply with its requirements?

 

The CRA does not only affect large software vendors. Smaller software developers, resellers, and Managed Service Providers (MSPs) may also fall within its scope if they develop digital products themselves, market products under their own brand, or substantially modify existing products.

 

However, companies that simply provide managed services based on clearly identifiable third-party software do not automatically become manufacturers under the CRA.

 

The key distinction is therefore whether a company places a digital product on the market or merely provides a service.

 

Companies that fall within the scope of the CRA will need to integrate cybersecurity more closely into the entire product lifecycle.This includes, in particular, cybersecurity risk assessments, security by design, secure default configurations, vulnerability management, secure update processes, and documentation of the software components used, for example through a Software Bill of Materials (SBOM).

 

Manufacturers must also define clear support periods (generally at least five years) during which they are responsible for effectively addressing vulnerabilities.

 

In addition, technical documentation, a conformity assessment, an EU Declaration of Conformity, and CE marking are required.

The conformity assessment determines whether a software product meets the essential cybersecurity requirements, such as not containing known exploitable vulnerabilities at the time of release, providing appropriate authentication mechanisms, and offering customers clear configuration guidance.

Software companies must be able to demonstrate which risks have been identified for a product, which security measures have been implemented, and how vulnerabilities will be handled after the product has been released.

 

One thing is therefore clear: the responsibility of software manufacturers does not end when a digital product is released. Simply publishing software and applying patches only when necessary is no longer sufficient.

 

This is why it is so important for manufacturers to know exactly which software libraries and components are included in their products. If a vulnerability is discovered, they must be able to identify affected components and address the issue as quickly as possible.