EU Cyber Resilience Act: What manufacturers will have to accomplish in the upcoming months

With the EU’s Cyber Resilience Act (CRA), the industry is dealing with one of the strictest regulatory requirements. Manufacturers, importers and even distributors of products with digital elements – in other words, anything with a microchip – will be required to take a number of stringent measures. So far, there are hardly any established procedures for this: “Among other things, the Cyber Resilience Act will require a cyber risk assessment before a product is put on the market. All manufacturers must start now to integrate the upcoming requirements into their product development, as the development of new products and variants often takes many months and years,” says Jan Wendenburg, CEO of ONEKEY. The company has published a concise guide for the industry, summarising the upcoming regulations, essential measures and practical tips for their implementation in the industry. In addition, ONEKEY is offering a 45-minute online seminar focusing on the legal basis and the implementation of CRA in existing workflows.

Documentation requirements and the need for a software bill of materials

In addition to security measures against unauthorised access, companies will also be required to manage software vulnerabilities and patches in the future – before damage is caused by exploitable vulnerabilities. “Throughout the entire product lifecycle, manufacturers must effectively manage the vulnerabilities of their products, conduct regular testing and demonstrate comprehensive patch management. There is also an obligation to maintain clear documentation.” Wendenburg continues. This includes maintaining a Software Bill of Materials (SBoM), that details all software products – including hidden ones – in a device or system. Depending on the product and the components installed, there can be hundreds of different assemblies, each with its own ‘brains’ and hidden risks. Staff structures also need to be put in place: Certain tasks and duties of the CRA need to be performed by an officer on behalf of the organisation. This includes, for example, the role of contact person for the market surveillance authorities.

Redesigning established processes

In addition to the documentation requirements, companies will have to regularly update the data inventory on the products and keep the data for up to ten years after the product has been placed on the market. “It is becoming clear that the pressure – even if the EU Commission postpones the CRA law somewhat – is high. Products and components, including those from third parties, must be tested for vulnerabilities, manufacturers, and importers must document this and provide the necessary capacity to meet the information obligations. For industry, this means rethinking established development and production processes. Those who do not act in time here risk high penalties from the authorities,” summarises Jan Wendenburg of ONEKEY. As a specialist in product cybersecurity, the company operates one of the world’s largest automated analysis platforms to examine products with digital elements for vulnerabilities that could be exploited by hackers. ONEKEY thus already provides the automated analysis and information that manufacturers urgently need to secure their products.

There’s plenty of other industrial editorial on our sister site, Electronic Specifier! Or you can always join in the conversation by commenting below or visiting our LinkedIn page.