Introduction
The Cyber Resilience Act (CRA) establishes common EU security expectations for products with digital elements. This article explains, in practical terms, what manufacturers, suppliers and R&D teams should implement: organizational and technical obligations, responsibilities to assign, and controls to introduce in the development lifecycle.
Who is affected
The regulation covers products embedding digital components (hardware, firmware, embedded software). Affected parties include:
- Manufacturers who design and place products on the market.
- Supply chain entities (distributors, importers, integrators) responsible for commercial compliance.
- Internal teams: R&D, product management, security, procurement and legal.
Key practical obligations
- Security by design and secure-by-default
- Integrate security from the earliest design phases: threat modelling, risk analysis and concrete security requirements.
- Use secure default configurations (least privilege, disable unnecessary services, randomized or enforced secure initial credentials).
- Updates and patch management
- Provide secure, authenticated and tamper-resistant update mechanisms (firmware/software).
- Define an update policy: roles for deployment, testing of patches, rollback procedures and secure distribution channels.
- Document a support/update period proportionate to the expected product lifetime and make it available to users.
- Technical documentation and transparency
- Supply clear user instructions for secure installation, configuration and operation.
- Maintain internal technical documentation that evidences security design choices (risk assessments, tests, change management records).
- Be ready to present information to market surveillance authorities when required.
- Vulnerability management and responsible disclosure
- Operate a formal process to receive, triage and remediate vulnerability reports (vulnerability disclosure policy).
- Coordinate disclosure with affected stakeholders and provide user notifications when necessary.
- Keep timelines and evidence of actions taken for reported issues.
- Conformity assessment and certification
- Plan for conformity assessment activities: internal testing, security audits and, where applicable, assessments by designated bodies or EU certification schemes.
- Keep records proving compliance and verification steps performed.
- Supply chain management and contract clauses
- Include contractual clauses with suppliers requiring minimum security standards and communication procedures for vulnerabilities.
- Establish acceptance controls for third-party components (third-party software, open-source libraries, hardware modules).
- User information and labeling
- Provide users with clear guidance on secure configurations and update policies.
- Prepare a concise summary of security features and limitations to help buyers make informed choices.
Practical implications for product managers and R&D: an operational checklist
Before production
- Perform threat modelling and document risk assessments.
- Specify security requirements and release acceptance criteria.
- Choose components with verifiable provenance and well-documented update policies.
During development
- Apply secure coding practices and regular code reviews.
- Integrate continuous security testing (SAST/DAST/pen tests) and mitigation plans.
- Maintain an inventory of software and hardware components (include an SBOM where possible).
At delivery and through the lifecycle
- Publish secure-configuration guidance and update management procedures.
- Document the support and update policy (duration, conditions, distribution channels).
- Implement a vulnerability disclosure process and user communication plan.
- Be prepared to demonstrate compliance through technical and organizational evidence.
Internal roles and responsibilities
- Product Manager: defines product security requirements and the patch roadmap.
- R&D/Engineering: implements security by design, performs updates and testing.
- Security Team: coordinates vulnerability management, independent testing and incident response.
- Legal/Compliance: reviews contract clauses, documentation and interactions with authorities.
- Procurement: assesses suppliers against security criteria and supply-chain controls.
Practical consequences and risk management
- Non-compliance can lead to market measures (withdrawal, sales bans), administrative penalties and reputational damage. The best defense is thorough documentation of processes and decisions, demonstrable testing, and robust update and communication channels.
Conclusion
Organizations must convert regulatory expectations into repeatable practices: integrate security by design into the development lifecycle, operate clear policies for updates and vulnerability handling, and maintain the technical and organizational evidence necessary for conformity assessment. The checklist above offers an operational starting point for product managers and R&D teams aligning products, contracts and processes with regulatory and market expectations.
