Build cybersecurity into the entire product lifecycle

The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, introduces horizontal cybersecurity requirements for products with digital elements made available on the European Union market.

It aims to improve the security of hardware and software products by establishing requirements for secure design and development, vulnerability handling, security updates, product information and conformity assessment.

For manufacturers, importers and distributors, the CRA introduces responsibilities that extend beyond the initial release of a product. Cybersecurity needs to be addressed throughout the product lifecycle, including the period during which vulnerabilities must be handled and security updates provided.

Cetbix GRC provides a central environment for managing governance, risks, controls, responsibilities, evidence and corrective actions. It can help organisations structure and oversee the activities that contribute to their CRA compliance programme.

1. Essential cybersecurity requirements

Annex I of the CRA establishes essential cybersecurity requirements for products with digital elements. Manufacturers must ensure that products are designed, developed and produced in accordance with the applicable requirements.

These requirements address the security properties of products and include measures intended to reduce cybersecurity risks.

Cetbix GRC can support the governance and oversight of product security requirements by connecting obligations to risks, controls, responsible stakeholders and evidence.

• Identify applicable cybersecurity requirements for products.
• Document product-related cybersecurity risks.
• Connect identified risks to security requirements and controls.
• Assign responsibility for implementation and review.
• Maintain evidence of security design and development activities.
• Track identified gaps and corrective actions.
• Monitor the implementation status of relevant requirements.

2. Secure-by-design and secure-by-default

The CRA requires manufacturers to consider cybersecurity throughout product design, development and production. Products should be designed to minimise cybersecurity risks and provide an appropriate level of security.

Secure-by-design and secure-by-default principles should be reflected in product development processes, technical decisions and release practices.

With Cetbix GRC, organisations can structure the governance activities associated with these principles.

• Document product security requirements and design decisions.
• Maintain product-related risk assessments.
• Record security reviews and development approvals.
• Assign security responsibilities to development and product teams.
• Link security requirements to implementation evidence.
• Track unresolved security findings and exceptions.

Recommended cybersecurity framework stack

Choosing the right framework combination

The appropriate framework combination depends on the type of product, its intended use, the organisation's development processes and its cybersecurity risk profile.

How Cetbix GRC supports framework-based CRA compliance

Using several frameworks can create overlapping requirements, duplicated controls and fragmented compliance evidence. A central GRC environment helps organisations bring these activities together.

Cetbix GRC can support a structured approach by connecting framework requirements, CRA obligations, product risks, controls, responsible owners and supporting documentation.

Important: Framework alignment is not automatic CRA compliance

ISO/IEC 27001 certification alone does not demonstrate that a product meets all CRA requirements. It primarily addresses the organisation's information security management system rather than every product-level cybersecurity obligation.

Similarly, IEC 62443 provides valuable product security processes and technical controls, particularly for industrial products, but its use does not automatically establish CRA conformity.

Manufacturers must assess their products against the applicable CRA requirements, including Annex I, and follow the relevant conformity assessment procedure. Harmonised standards provide a presumption of conformity only for the requirements they cover and where the relevant references have been published in the Official Journal of the European Union.

A practical starting point is to combine ISO/IEC 27001 for organisational governance, IEC 62443-4-1 or NIST SSDF for secure development, and relevant product security standards for technical controls. All applicable requirements and evidence should then be mapped to the CRA.

Cetbix GRC can help manage this mapping and provide visibility into framework implementation, regulatory coverage, outstanding gaps and corrective actions.

3. Vulnerability handling throughout the product lifecycle

One of the central elements of the CRA is the obligation for manufacturers to handle vulnerabilities effectively during the product's support period.

Manufacturers need to establish appropriate processes to identify, document, assess and address vulnerabilities, including vulnerabilities in components integrated into their products.

Cetbix GRC can support the governance and oversight of vulnerability management activities.

• Maintain visibility of product-related cybersecurity risks.
• Document identified vulnerabilities and their associated impact.
• Connect vulnerabilities to affected products and components.
• Assign owners for investigation and remediation.
• Track security updates and corrective measures.
• Maintain supporting evidence and remediation records.
• Monitor outstanding vulnerabilities and overdue actions.

Effective vulnerability handling also requires appropriate technical processes, development practices and operational capabilities. A GRC platform supports governance and traceability but does not replace vulnerability scanning, secure development or patch management tools.

4. Software supply-chain and component security

Modern digital products often depend on third-party software, open-source components, libraries and external technology providers. These dependencies can introduce cybersecurity risks that manufacturers need to understand and manage.

The CRA includes requirements concerning the identification and handling of vulnerabilities in components. It also requires manufacturers to prepare a software bill of materials (SBOM) in a commonly used and machine-readable format, covering at least the top-level dependencies of the product, subject to the Regulation's provisions.

Cetbix GRC can help structure the governance and risk management activities associated with product supply chains.

• Maintain an overview of relevant suppliers and technology dependencies.
• Document third-party and open-source component risks.
• Connect supplier risks to affected products and services.
• Record supplier assessments and assurance documentation.
• Maintain references to SBOMs and supporting product documentation.
• Track component-related vulnerabilities and remediation actions.
• Monitor supplier issues and periodic reviews.

5. Vulnerability and incident reporting

The CRA introduces mandatory reporting obligations for manufacturers in relation to actively exploited vulnerabilities and severe incidents having an impact on the security of products with digital elements.

From 11 September 2026, manufacturers must submit the applicable notifications through the CRA Single Reporting Platform established and maintained by ENISA.

Cetbix GRC can support the internal governance and evidence management associated with these reporting processes.

• Record vulnerability and incident-related findings.
• Connect incidents to affected products, risks and controls.
• Assign investigation and remediation responsibilities.
• Document decisions, impact assessments and corrective measures.
• Maintain supporting evidence and management oversight.
• Track reporting-related actions and deadlines.

Important: Cetbix GRC records should not be presented as a substitute for submitting mandatory notifications through the official CRA Single Reporting Platform. Reporting responsibilities and deadlines remain with the relevant economic operator.

6. Product support periods and security updates

The CRA requires manufacturers to determine an appropriate support period during which vulnerabilities are handled effectively. The support period must take account of the expected use of the product, the nature of the product and other relevant factors.

Manufacturers must also provide information about the support period, including its end date, in accordance with the Regulation.

Cetbix GRC can support the governance of product lifecycle obligations.

• Document product support-period decisions.
• Assign responsibility for product security maintenance.
• Record relevant security update and vulnerability handling policies.
• Maintain evidence of product lifecycle reviews.
• Track outstanding lifecycle-related risks and corrective actions.

7. Technical documentation and conformity assessment

The CRA requires manufacturers to prepare technical documentation demonstrating how applicable cybersecurity requirements have been addressed.

Depending on the product category and applicable conformity assessment procedure, manufacturers may need to carry out an internal assessment or involve a notified body. Products that meet the applicable requirements are subject to the relevant EU conformity and CE marking provisions.

Cetbix GRC can provide a structured environment for managing compliance responsibilities and associated documentation.

• Maintain a register of applicable regulatory requirements.
• Link requirements to product risks and implemented controls.
• Record assessments, reviews and approvals.
• Organise supporting documents and evidence.
• Track findings and corrective actions.
• Provide management visibility into compliance progress.

From CRA requirement to risk, control and evidence

Regulatory compliance becomes operational when product requirements are connected to risks, responsible owners, implementation evidence and corrective actions.

The result: Product cybersecurity obligations can be managed through a structured governance process rather than disconnected spreadsheets, documents and action lists.

A structured CRA compliance workflow

1. Determine applicability: Identify relevant products, product categories and the organisation's role in the supply chain.
2. Identify requirements: Establish which CRA obligations apply to the products and the organisation.
3. Assess product risks: Document cybersecurity risks associated with product design, development, components and operation.
4. Define controls: Connect applicable requirements to security measures and implementation activities.
5. Assign ownership: Establish accountability across Product, Engineering, Security, Legal and Supplier Management.
6. Collect evidence: Maintain relevant assessments, technical documents, SBOM references, security reviews and other records.
7. Manage vulnerabilities: Track findings, remediation, security updates and related actions.
8. Monitor compliance: Review implementation progress, outstanding gaps and lifecycle obligations.

More than a regulatory checklist

Cyber Resilience Act: important implementation dates

Organisations should prepare ahead of the full application date and address the reporting obligations that already apply. Transitional provisions and specific product circumstances should also be considered.

Who can benefit from Cetbix GRC?

• Manufacturers of hardware and software products.
• Technology companies placing products on the EU market.
• Software developers and product engineering organisations.
• Organisations integrating third-party and open-source components.
• Importers and distributors of products with digital elements.
• Product security and vulnerability management teams.
• Risk, compliance, quality and internal audit departments.
• Organisations managing complex product and supplier ecosystems.

Frequently asked questions

What is the Cyber Resilience Act?

The Cyber Resilience Act is Regulation (EU) 2024/2847. It establishes horizontal cybersecurity requirements for products with digital elements made available on the EU market.

Which products are covered by the CRA?

The CRA broadly covers hardware and software products with digital elements, including relevant components placed separately on the market. The Regulation contains specific scope provisions and exclusions, so applicability must be assessed for each product.

When does the CRA apply?

The main obligations apply from 11 December 2027. The reporting obligations concerning actively exploited vulnerabilities and severe incidents have applied since 11 September 2026.

Does the CRA require vulnerability management?

Yes. Manufacturers must establish appropriate vulnerability handling processes and handle vulnerabilities effectively during the applicable product support period, including vulnerabilities in relevant components.

What is an SBOM?

A Software Bill of Materials is a structured inventory of software components used in a product. The CRA includes requirements for manufacturers to prepare an SBOM in a commonly used and machine-readable format, covering at least the top-level dependencies, subject to the Regulation.

Does Cetbix GRC automatically make a product CRA compliant?

No. A GRC platform supports governance, risk management, control oversight and evidence management. The manufacturer and other relevant economic operators remain responsible for meeting their legal obligations and ensuring that the product satisfies applicable requirements.

Can Cetbix GRC support other regulatory frameworks?

Cetbix is designed to support governance, risk and compliance activities across regulatory frameworks. The available framework libraries and specific CRA workflows should be confirmed against the capabilities configured in the relevant Cetbix environment.

The Cyber Resilience Act refers to Regulation (EU) 2024/2847. This page is for general information and does not constitute legal advice. Product scope, economic operator responsibilities, conformity assessment and reporting obligations should be assessed against the Regulation and applicable guidance.