Early warning
Submit basic facts, affected products or versions, known exploitation and initial mitigation.
02 · CYBER RESILIENCE ACT
EU CRA
Compliance and Testing
Build a compliance evidence chain around horizontal standards, product-specific vertical drafts, vulnerability reporting and secure development across the full product lifecycle.
Key obligation
Vulnerability reporting is a timed process, not just an email
Reports mainly concern actively exploited vulnerabilities and serious incidents affecting product security, users or network services.
Detailed notification
Add vulnerability nature, severity, impact scope, indicators, measures taken and remediation plan.
Final vulnerability report
Explain root cause, impact, exploitation, corrective measures, security update and user communication.
Final incident report
Provide investigation conclusion, handling process, impact assessment and measures to prevent recurrence.
READINESS CHECKLIST
Finish a tabletop exercise before 2026-09-11
- 7×24 vulnerability and incident intake channel
- PSIRT, R&D, legal, management and external contacts
- Rules for active exploitation and serious incident triage
- 24h, 72h and final report templates
- Fast lookup for product, version, SBOM and customer impact
- At least one tabletop and one practical response drill
Horizontal standards
prEN 40000 series: common compliance baseline
Horizontal standards help manufacturers build reusable requirement libraries, development processes and evidence templates for products with digital elements.
prEN 40000-1-1Concepts
Definitions and terminology
Unifies terms such as product, component, asset, vulnerability, risk, support period, security update and supply-chain role.
- Clarify product boundary, data flow and responsibility matrix.
- Map legal clauses to product functions and evidence.
- Align vulnerability, incident, fix and mitigation definitions.
prEN 40000-1-2Principles
Cyber resilience principles
Translates risk-oriented, secure-by-design and secure-by-default principles into lifecycle practices.
- Perform risk analysis based on intended and foreseeable use.
- Embed least privilege, defense in depth and secure defaults.
- Plan monitoring, update and end-of-support arrangements.
prEN 40000-1-3Vulnerability
Vulnerability handling requirements
Defines intake, validation, severity rating, fixing, coordinated disclosure and records as a basis for PSIRT and CRA reporting.
- Set a unified vulnerability contact, SLA and owner.
- Keep affected version, risk decision, patch and communication evidence.
- Connect 24h, 72h and final CRA reporting milestones.
prEN 40000-1-4Controls
Common product security controls
Converts CRA Annex I requirements into testable controls around identity, access, confidentiality, integrity, logging, updates and resilience.
- Decide applicability and non-applicability rationale for each control.
- Define evidence for configuration, interfaces, updates and recovery.
- Add product-specific scenarios through vertical standards.
Status note: Final references, clauses and harmonized status should always be locked to the latest official publications before project delivery.
Vertical standard drafts
EN 304 xxx: product-specific risk and evidence
Vertical drafts refine verification priorities for browsers, operating systems, routers, smart home products, wearables and other concrete categories.
Browsers
Web isolation, certificate validation, download protection, extension permissions, privacy data and automatic update.
Password managers
Master key protection, credential encryption, autofill boundaries, synchronization, recovery and leakage risks.
Anti-virus software
Engine integrity, signature updates, quarantine handling, trusted update and privileged execution risks.
VPN software
Tunnel protocol, key management, authentication, traffic leakage, default configuration and client updates.
Network interfaces
Exposed services, protocol implementation, interface authorization, input handling and attack surface minimization.
Operating systems
Privilege separation, secure boot, patching, logging, credential protection and secure defaults.
Routers and switches
Management interface, segmentation, firmware update, initial credential, configuration backup and exposure risks.
Firewalls
Default policy, rule integrity, administrator privileges, audit logging, updates and secure failure behavior.
Smart home assistants
Voice and account data, wake-up control, third-party skills, linkage authorization and cloud communication.
Smart home security products
Cameras, locks and alarms with remote access, account sharing, privacy protection and alert reliability.
Connected toys and child-care devices
Children's data, guardian authorization, audio/video functions, location data, defaults and remote control.
Wearables
Health and location data, mobile pairing, wireless interfaces, account security, cloud sync and loss scenarios.
Secure development lifecycle
Embed CRA requirements into product SDLC
Compliance should not be a last-minute document task. Each development stage should produce traceable security inputs, review gates and evidence.
Scope and roles
Identify product boundary, digital components, target markets, supply-chain roles and support period.
Output: applicability list and responsibility matrixRisk and threat modeling
Map assets, data flow, trust boundaries, attacker capability, foreseeable misuse and lifecycle risks.
Output: threat model and risk treatment planSecurity requirements
Turn authentication, authorization, encryption, logging, updates and interface protection into verifiable requirements.
Output: requirements and architecture reviewSecure coding and supply chain
Apply coding rules, code review, secret handling, dependency governance, supplier evidence and SBOM maintenance.
Output: code review, SBOM and supplier evidenceSecurity verification
Combine SAST, DAST, dependency scanning, fuzzing, interface testing, penetration testing and remediation retest.
Output: test plan, findings and retest reportRelease evidence
Complete risk acceptance, secure-default check, technical documentation, user guidance and release approval.
Output: technical file and release sign-offMonitoring and PSIRT
Collect vulnerability intelligence and feedback, complete triage, fixes, disclosure, reporting and user notification.
Output: reporting and communication recordsUpdates and support
Provide security updates during the support period and communicate end-of-support and secure retirement.
Output: update records and EOL planNeed to turn CRA clauses into product tasks?
Share product type, architecture, software components, target markets and development stage for a tailored roadmap.