Posts related to the EU's Cyber-Resilience Act.
View All Tags
In July 2026, ENISA published the Secure by Design and Default Playbook, a practical guide aimed at small and medium-sized manufacturers building products with digital elements (ENISA publication, PDF). It is a welcome addition to the CRA guidance landscape: clear principles, repeatable engineering actions, and release gates that lean teams can actually use.
On 17 June 2026, ETSI's work item for EN 304 623, Cybersecurity requirements for boot managers, entered the deliverable approval procedure. The public draft shows how the Cyber-Resilience Act (CRA) is reaching below operating systems and applications into the firmware that establishes the first chain of trust.
The Cyber-Resilience Act (CRA) reporting clock starts on 11 September 2026. From that date, manufacturers must report actively exploited vulnerabilities and severe incidents affecting the security of products with digital elements through the ENISA Single Reporting Platform (SRP) (Commission reporting guidance, ENISA SRP page).
On 4 March 2026, STMicroelectronics announced a dedicated Cyber Resilience Act (CRA) resource hub for developers and product teams. The move is notable not just because of ST's size, but because it shows how fast the market is shifting: component vendors are no longer talking only about features, performance, and price. They are increasingly talking about security lifecycle, documentation, and compliance support for products with digital elements (ST announcement).
On 3 December 2025, the European Commission published its first Frequently Asked Questions document on the Cyber Resilience Act (CRA). This is the first official implementation guidance since the regulation was published in November 2024, and it provides important clarifications on how manufacturers should approach compliance.
The FAQ is a substantial document covering scope, product classification, manufacturer obligations, vulnerability reporting, conformity assessment, and timelines. For product teams preparing for the December 2027 deadline, Chapters 4 (Manufacturer Obligations) and 5 (Reporting) contain the most actionable guidance.
The European Commission has published Implementing Regulation (EU) 2025/2392, providing the detailed technical descriptions that define exactly which products fall into the CRA's "Important" and "Critical" risk categories. This is the first major piece of secondary legislation under the Cyber-Resilience Act, and it removes much of the ambiguity around product classification.
The Cyber-Resilience Act (CRA) is the EU's first horizontal law that legally mandates Secure-by-Design for products with digital elements. It sets clear obligations for confidentiality and integrity, but it deliberately avoids naming specific algorithms or key sizes. That raises an immediate question for device makers:
What exactly counts as “state-of-the-art” cryptography under the CRA?
Inspired by Markku-Juhani O. Saarinen’s paper “CRA and Cryptography: The Story Thus Far” (IACR ePrint 2025/2092), this post explains how European standardisation work is answering that question – and what it means for your products.
On November 20, 2024, the Cyber-Resilience Act (CRA) was officially published in the EU's Official Journal as Regulation (EU) 2024/2847. This marks the final, formal step in a legislative process that will fundamentally reshape the market for connected devices.
Welcome to the SecureByDesignHandbook.com project!