With the EU Cyber Resilience Act (CRA), the industry is dealing with one of the strictest regulatory requirements. Manufacturers, importers and even distributors of products with digital elements – in other words, anything with a microchip – will be required to take a number of stringent measures.
So far, there are hardly any established procedures for this: “Among other things, the EU Cyber Resilience Act will require a cyber risk assessment before a product is put on the market. All manufacturers must start now to integrate the upcoming requirements into their product development, as the development of new products and variants often takes many months and years,” says Jan Wendenburg, CEO of ONEKEY.
Documentation requirements and the need for a SBOM
In addition to security measures against unauthorised access, companies will also be required to manage software vulnerabilities and patches in the future – before damage is caused by exploitable vulnerabilities.
“Throughout the entire product lifecycle, manufacturers must effectively manage the vulnerabilities of their products, conduct regular testing and demonstrate comprehensive patch management. There is also an obligation to maintain clear documentation,” Wendenburg continues.
This includes maintaing a Software Bill Of Materials (SBOM), that details all software products – including hidden ones –in a device or system. Depending on the product and the components installed, there can be hundreds of different assemblies, each with its own “brains” and hidden risks.
Staff structures also need to be put in place: Certain tasks and duties of the CRA need to be performed by an officer on behalf of the organisation. This includes, for example, the role of contact person for the market surveillance authorities.
Redesigning established processes
In addition to the documentation requirements, companies will have to regularly update the data inventory on the products and keep the data for up to ten years after the product has been placed on the market.
“It is becoming clear that the pressure – even if the EU Commission postpones the law somewhat – is high. Products and components, including those from third-parties, have to be tested for vulnerabilities, manufacturers and importers must document this and provide the necessary capacity to meet the information obligations. For industry, this means rethinking established development and production processes. Those who do not act in time here risk high penalties from the authorities,” Jan Wendenburg concluded.