Secure Development Lifecycle Requirements under the CRA
Few terms come up as often in discussions of the Cyber Resilience Act as “security by design”, and few are misunderstood as often. Security by design is not an attitude, …
Category - Cyber Resilience Act
ENISA Secure by Design and Default Playbook
On July 30, 2026, ENISA published the Secure by Design and Default Playbook. It translates 22 security principles into checklists, evidence, and release criteria. It also maps them to the …
When In-House Developments Fall under the CRA
“This doesn't affect us, we don't even sell the software.” Compliance managers often hear this when the Cyber Resilience Act (CRA) comes up in connection with products developed in-house. The …
European Commission Publishes Guidance on the CRA
On July 27, 2026, the European Commission published its guidance on applying the Cyber Resilience Act (C(2026) 5252). It is aimed at manufacturers and other economic operators who need to …
Implementing the Machinery Regulation and the CRA as One Project
Take a connected machine controller with remote maintenance access that you place on the market from 2027. It falls under two EU acts at once: the Machinery Regulation and the …
How to Plan Your CRA Compliance Budget
The Cyber Resilience Act (Regulation (EU) 2024/2847), or CRA, applies in full from December 11, 2027 . The budgets that cover this date fund exactly the period in which the …
Creating an SBOM for the CRA
Many see the software bill of materials as the big hurdle in the Cyber Resilience Act. They picture an elaborate scan, an expensive tool, and an endless list. A close …
How the CRA Reporting Process Works in Practice
Since September 11, 2026, manufacturers must report actively exploited vulnerabilities and severe incidents via ENISA's Single Reporting Platform. Filling in the form on the platform is quick. The harder part …
CRA Reporting Deadlines for Vulnerabilities and Severe Incidents
Since September 11, 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents through the central EU reporting platform. Article 14 of the Cyber Resilience …
CRA Reporting Obligations for Products Already on the Market
Most manufacturers have December 11, 2027, in their plans: the date from which all requirements of the Cyber Resilience Act apply in full. Fewer know that one central obligation applies …