CVEs, Vulnerability Handling, and Reporting under the CRA
Two statements come up in almost every conversation about the Cyber Resilience Act. The first: “Since September, we have to report every vulnerability.” The second: “And we have to fix …
Category - Regulation
When a Machinery Retrofit Makes You the Manufacturer
You add a new robot to an existing machine, replace the old control system with a connected one, or increase the cycle rate. To you, this is a modernization. Legally, …
Secure Development Lifecycle Requirements under the CRA
Few terms come up as often in discussions of the Cyber Resilience Act as “security by design”, and few are misunderstood as often. Security by design is not an attitude, …
ENISA Secure by Design and Default Playbook
On July 30, 2026, ENISA published the Secure by Design and Default Playbook. It translates 22 security principles into checklists, evidence, and release criteria. It also maps them to the …
When In-House Developments Fall under the CRA
“This doesn't affect us, we don't even sell the software.” Compliance managers often hear this when the Cyber Resilience Act (CRA) comes up in connection with products developed in-house. The …
European Commission Publishes Guidance on the CRA
On July 27, 2026, the European Commission published its guidance on applying the Cyber Resilience Act (C(2026) 5252). It is aimed at manufacturers and other economic operators who need to …
Implementing the Machinery Regulation and the CRA as One Project
Take a connected machine controller with remote maintenance access that you place on the market from 2027. It falls under two EU acts at once: the Machinery Regulation and the …
How to Plan Your CRA Compliance Budget
The Cyber Resilience Act (Regulation (EU) 2024/2847), or CRA, applies in full from December 11, 2027 . The budgets that cover this date fund exactly the period in which the …
Creating an SBOM for the CRA
Many see the software bill of materials as the big hurdle in the Cyber Resilience Act. They picture an elaborate scan, an expensive tool, and an endless list. A close …
How the CRA Reporting Process Works in Practice
Since September 11, 2026, manufacturers must report actively exploited vulnerabilities and severe incidents via ENISA's Single Reporting Platform. Filling in the form on the platform is quick. The harder part …