ETSI Draft Standards for the Cyber Resilience Act
This article describes the status as of September 2025, when ETSI published early drafts (versions 0.0.x) for consultation. For the current status, see our overview of harmonized standards for the CRA.
The European Telecommunications Standards Institute (ETSI) has reached a milestone in implementing the Cyber Resilience Act (CRA). It has published seven draft standards for different product categories for public consultation. The drafts are the first concrete link between the legal requirements of the CRA and their practical, technical implementation.
Contents
The published drafts
ETSI has made the following drafts available on its open consultation platform:
| Draft | Product category | Version | Date |
|---|---|---|---|
| EN 304 618 | Password managers | 0.0.3 | Sep 29, 2025 |
| EN 304 619 | Antivirus | 0.0.5 | Sep 30, 2025 |
| EN 304 623 | Boot managers | 0.0.4 | Sep 30, 2025 |
| EN 304 625 | Network interfaces | 0.0.5 | Sep 22, 2025 |
| EN 304 626 | Operating systems | 0.0.6 | Sep 22, 2025 |
| EN 304 627 | Routers, modems, switches | 0.0.7 | Sep 29, 2025 |
| EN 304 635 | Virtualization and containers | 0.0.6 | Oct 1, 2025 |
Together, the drafts run to more than 400 pages. They form an extensive framework, but they will still be revised considerably.
How the drafts are structured
All seven drafts follow the same four-step approach. It makes the cybersecurity requirements clear and traceable.
1. Use cases: realistic deployment scenarios
Each draft starts with concrete use cases that describe typical deployment scenarios for products with digital elements.
Example from EN 304 627 (routers, modems, switches): The “home modem” use case describes the typical home environment, the security measures already in place, and expected usage such as web browsing, working from home, and online gaming. This realistic approach helps manufacturers put their products in the right context.
2. Threats and risk considerations
Building on the use cases, the drafts analyze the threats systematically. They identify specific risk factors and take the capabilities of the product into account in the risk assessment.
Example from EN 304 626 (operating systems): The draft classifies risk tolerance in four levels. They range from critical environments (RT-C: high sensitivity, low tolerance) to environments with high risk tolerance (RT-H: negligible potential harm, no expectation of regular security updates). The classification is based on the product of potential harm and likelihood of occurrence.
3. Mitigations: security measures and requirements
To address the identified risks, the drafts propose mitigations. They include technical requirements and security measures that must be implemented.
EN 304 627 (routers) takes an interesting approach with “capability-based conditions”: the specific capabilities of a product determine which security requirements are relevant. This allows the standard to be applied flexibly and in a way that fits the product.
4. Assessment: objective testability
The drafts define test criteria for assessing whether the requirements are met. EN 304 625 (network interfaces) stresses that the requirements should ideally be objectively testable on an instance of the product. Market surveillance authorities can then assess them independently.
Where necessary, the drafts use “check-box requirements”. These are structured decision trees that give manufacturers a framework for documenting why they consider their product compliant.
What the drafts mean in practice
Publishing the drafts this early is notable. It gives manufacturers and other stakeholders several advantages:
- Early insight: The drafts give a useful overview of the direction and scope of the standardization work, even though substantial revisions are still expected.
- Influence: The public consultation lets industry submit feedback and help shape the final standards.
- Planning certainty: Companies can start aligning their products and processes with the coming requirements now.
What manufacturers should do now
Manufacturers of affected products should review the drafts relevant to them carefully and take part in the consultation. The comment templates are available on the ETSI open consultation platform.
If you have questions about contacting the responsible ETSI committees or submitting comments, contact your national standards organization or ETSI TC CYBER-EUSR directly.
Our assessment
With these seven drafts, ETSI makes the abstract requirements of the Cyber Resilience Act tangible and workable. Use cases, risk factors, mitigations, and assessment give manufacturers a clear structure to work with.
We thank the members of ETSI TC CYBER-EUSR for their work on these standards. Opening the consultation early is a positive signal for transparent and practical standardization in cybersecurity.
The ETSI drafts are an important intermediate step toward CRA conformity, but they do not replace an assessment of your own products. If you want to understand what the drafts mean for your products and which next steps make sense, we can clarify this in a no-obligation call.
