Cyber Resilience Act Implementation Consulting

CRA (Cyber Resilience Act) is an EU regulation on cybersecurity, mandatory for all manufacturers, distributors, and importers of software and hardware products with digital components who want to market their products in the countries of the European Union. It is a comprehensive law designed to provide:

• Security throughout the entire product lifecycle, from requirements and design to post-production and support.
• Consistent requirements for producers and digital product standardization across the entire EU’s internal market.
• Greater consumer confidence in product security and business accountability 

There are two key deadlines for organizations achieving CRA compliance:

11 September 2026: Vulnerability and incident reporting. From this date, manufacturers must proactively detect exploited vulnerabilities in their digital products and report them within 24 hours.

11 December 2027: Full CRA compliance is required. All software and hardware products with digital elements designed for the EU market must comply with CRA requirements.

CRA covers the parts of the digital product development process that impact product security, specifically:

• Risk management throughout its lifecycle
• Secure design and development practices
• Vulnerability handling and update management
• Technical documentation and process transparency.

First of all, manufacturers are expected to implement a secure-by-design development approach, which implies considering system security as early as project planning. This includes regular security testing and reviews, as well as coordinated disclosure and reporting of identified vulnerabilities within a short period of time. Also, CRA compliance requires rigid system and process documentation to ensure transparency for users. Finally, timely security fixes and regular, accessible updates must be provided.

CRA compliance is more of a continuous process than a one-time activity, with lifecycle-based product security. Therefore, it implies two investment layers:

Up-front investment for initial process setup, needed tooling, infrastructure, and documentation development. For existing products with identified gaps, this will also include remediation costs for redesign and refactoring.

Ongoing investment for continuous operations like vulnerability detection and reporting, testing, updates, incident handling, and documentation maintenance.

Essentially, you can treat CRA compliance expenses as your investment in establishing future-ready and mature cybersecurity practices. On average, existing but inconsistent security practices may form up to 25% of the entire development cost, while for legacy products, the number is even higher. At the same time, companies that integrate security from the project’s start can avoid reengineering and save 10-20% of their total development costs.