When In-House Developments Fall under the CRA
“This doesn't affect us, we don't even sell the software.” Compliance managers often hear this when the Cyber Resilience Act (CRA) comes up in connection with products developed in-house. The …
Category - Product Security
European Commission Publishes Guidance on the CRA
On July 27, 2026, the European Commission published its guidance on applying the Cyber Resilience Act (C(2026) 5252). It is aimed at manufacturers and other economic operators who need to …
How to Plan Your CRA Compliance Budget
The Cyber Resilience Act (Regulation (EU) 2024/2847), or CRA, applies in full from December 11, 2027 . The budgets that cover this date fund exactly the period in which the …
When IEC 62443 Certification Makes Sense under the CRA
Many manufacturers assume that the Cyber Resilience Act (Regulation (EU) 2024/2847), or CRA, forces them to get IEC 62443 certification. It does not. For a large share of products, the …
Choosing the Right IEC 62443 Security Level for Your Product
Manufacturers working with IEC 62443 often ask one question first: “Which security level does our product have to meet?” The short answer is that you do not decide this alone. …
CRA Reporting Deadlines for Vulnerabilities and Severe Incidents
Since September 11, 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents through the central EU reporting platform. Article 14 of the Cyber Resilience …
Germany's CRA Implementation Act and the Role of the BSI
The Cyber Resilience Act (Regulation (EU) 2024/2847), or CRA, applies directly in every EU Member State. Each Member State still decides which national authorities enforce it. This article uses Germany …
How TARA, Threat Models, and Cybersecurity Risk Assessments Differ
Risk assessment, risk management, threat model, threat analysis, TARA, cybersecurity risk assessment: these terms come up again and again in projects for connected products. Sometimes they mean the same thing, …
Which Harmonized Standards Apply under the CRA
Manufacturers of machinery, plant, and devices keep asking the same question about the Cyber Resilience Act (CRA): which standard should I apply to demonstrate that I meet the requirements? The …
MDR Cybersecurity Reporting Obligations Close the CRA Gap for Medical Devices
On December 16, 2025, the European Commission presented its simplification proposal COM(2025) 1023 for the Medical Devices Regulation (MDR) and the In Vitro Diagnostic Medical Devices Regulation (IVDR). Most attention …