ENISA Maps CRA Requirements to Existing Standards

  • Markus Müller
  • 1 min read

ENISA, the EU Agency for Cybersecurity, has today published a document that will interest anyone working on the implementation of the Cyber Resilience Act (CRA). It shows in detail how the requirements of the CRA correspond to existing standards, including IEC 62443 and ETSI EN 303 645. The mapping is the result of a joint analysis by the European Commission's Joint Research Centre (JRC) and ENISA.

The growing number of cyberattacks and the financial burden they cause call for a solid legal framework. This is where the CRA comes in: it defines essential cybersecurity requirements for manufacturers of products with digital elements. The publication makes the CRA requirements easier to implement by mapping them to existing standards that manufacturers can apply.

The mapping supports further standardization work, and it is also a valuable resource for anyone working toward CRA compliance. Many thanks to the ENISA and JRC teams for their excellent work. Anyone who deals with product security should read it.

You can find the mapping and further information on the ENISA website: Cyber Resilience Act Requirements Standards Mapping.

A mapping does not replace your own assessment. Which parts of the standards are actually relevant for your product remains a matter of interpretation. If you want to work out this mapping for your products, we can clarify it together in a no-obligation call.

Book a call

Choosing a CRA consultant? Here is how to find the right one.

Get the guide

Book a call

Send us your request. Together we will look at where your company stands, which questions are still open, and what the sensible next steps are.

For information on how we process your data, see our privacy policy.

Guide: How to choose the right CRA consultant

CRA consulting offers are hard to compare. One provider delivers only a gap analysis, another also supports the technical implementation, and both call themselves “CRA consultants.” If you ask the wrong questions, you end up paying for services you don't need, or you find out halfway through the project that key expertise is missing.

Our guide shows manufacturers what really matters when choosing a provider, from the expertise you need to the right pricing model and the 20 questions you should ask every provider.

What the guide covers:

  • the seven areas of expertise a complete CRA implementation requires
  • four support models depending on your in-house capacity and expertise
  • 20 specific questions for your next provider meeting
  • a red flag card for spotting warning signs quickly
  • a scoring sheet with rating guidance for a structured comparison of providers

Download it for free

For information on how we process your data, see our privacy policy.

Free templates: CRA reporting process

Prepare your company for the reporting obligations under the Cyber Resilience Act. You get process descriptions and templates tested in practice for:

  • reporting actively exploited vulnerabilities
  • reporting severe incidents
  • the required early warning notifications, notifications, and final reports
  • clear responsibilities, escalation paths, and deadlines

Enter your contact details and we will email you the files.

For information on how we process your data, see our privacy policy.

Free template: Risk assessment according to EN 50742

We use this template in our consulting projects for systematic threat assessment. You get an Excel template with:

  • a structured threat assessment for your machinery
  • a systematic way to determine safety-related security levels (SRSL)
  • documentation of vulnerabilities and protective measures

Enter your contact details and you will receive the template within minutes.

For information on how we process your data, see our privacy policy.

Free template: SBOM

We use this template in our consulting projects to meet the CRA requirements for the software bill of materials.

Enter your contact details and you will receive the template within minutes.

For information on how we process your data, see our privacy policy.

Free template: Vulnerability disclosure policy

We use this template in our consulting projects to meet the CRA requirements for vulnerability handling. You get a Word template with:

  • a structure based on EN 40000-1-3
  • predefined sections for reporting channels, response times, and responsibilities
  • safe harbor clauses for security researchers

Enter your contact details and you will receive the template within minutes.

For information on how we process your data, see our privacy policy.