Cyber Resilience Act (CRA) compliance for everyone
The Cyber Resilience Act (CRA) is a European Union regulation designed to improve the cybersecurity of products with digital components. It applies to manufacturers, importers, and distributors, requiring them to ensure their products are secure throughout their lifecycle. While the CRA sets strict legal requirements, achieving compliance can be challenging. This is where CRACY comes in—a project designed to simplify the process for all stakeholders, from manufacturers to end customers.
What is CRACY?
CRACY is a practical initiative that helps organizations meet the requirements of the Cyber Resilience Act in a clear and efficient way. Its goal is to provide a simple, actionable approach to compliance that works for a wide range of products and services, including IoT devices, industrial machines, and digital services.
CRACY’s Three Main Objectives
CRACY focuses on three main objectives:
Helping business teams understand their responsibilities
Ensuring that manufacturers, importers, and distributors know what is required of them under the CRA.
Providing transparency to customers
Making sure users understand the cybersecurity features and lifecycle support they can expect from a product.
Enabling compliance through practical measures
Offering a clear path for organizations to implement the technical and organizational measures needed to meet CRA requirements.
By addressing these objectives, CRACY simplifies the compliance process and ensures that all stakeholders—from business teams to end users—are aligned and informed.
CRA Compliance Made Actionable
CRACY provides a step-by-step approach to compliance, focusing on selecting the right control objectives, mapping them to CRA requirements, and documenting the measures taken to meet those objectives. This process ensures that compliance is measurable, reportable, and demonstrable.
Step 1: Select the right framework
To comply with the CRA, organizations must choose a recognized cybersecurity framework that aligns with the regulation’s requirements. Examples include:
- ENISA Cybersecurity Certification Framework: A structured approach to certifying the cybersecurity of ICT (Information and Communication Technology) products and services.
- ISO/IEC 27001: A globally recognized standard for managing information security risks.
- ETSI EN 303 645: A standard specifically designed for IoT security, covering areas like secure software updates and data protection.
Step 2: Map control objectives to CRA requirements
Control objectives are specific goals that help organizations meet the CRA’s legal requirements. For example:
- Secure development practices: Ensuring products are designed and built with security in mind.
- Vulnerability management: Implementing processes to identify and address vulnerabilities throughout the product lifecycle.
- Patching and updates: Providing secure and timely updates to address emerging threats.
By mapping these objectives to the CRA’s requirements, organizations can create a clear roadmap for compliance.
Step 3: Document and implement measures
Once the control objectives are defined, organizations must document the specific measures they will take to meet those objectives. These measures should include both technical and organizational actions. For example:
- Technical measure: Implementing an automated, secure patch delivery system for IoT devices.
- Organizational measure: Establishing a clear incident response plan to handle cybersecurity threats.
This documentation provides evidence of compliance and ensures that all stakeholders understand their roles and responsibilities.
Why CRACY matters for all stakeholders
CRACY is designed to benefit everyone involved in the lifecycle of a product with digital components, from manufacturers to end users.
For manufacturers
CRACY simplifies the compliance process by providing a clear framework for meeting CRA requirements. It helps manufacturers:
- Understand their legal obligations.
- Implement secure development practices.
- Provide lifecycle support for their products.
For importers and distributors
CRACY ensures that importers and distributors can confidently place products on the EU market, knowing they meet CRA requirements. It also provides transparency, making it easier to communicate product security features to customers.
For customers
CRACY gives customers confidence in the security of the products they purchase. By requiring manufacturers to document and communicate their cybersecurity measures, CRACY ensures that users understand:
- The product’s cybersecurity features.
- The support they can expect throughout the product’s lifecycle.
- How vulnerabilities will be addressed through updates and patches.
Practical example: Patching for IoT Devices
To illustrate how CRACY works, consider an IoT device with a 10-year expected lifespan. Under the CRA, the manufacturer must:
Control Objective
Ensure secure and timely patching throughout the product lifecycle.
Measure
Implement an automated, secure patch delivery system that applies updates without user intervention. Use cryptographic signing to verify the authenticity of patches.
Documentation
Provide a lifecycle support plan in contracts, guaranteeing patching for 10 years. Include details on how updates are delivered, verified, and monitored.
This approach ensures the device remains secure throughout its lifecycle, meeting both technical and organizational requirements. It also provides customers with confidence that the product will be supported and protected against emerging threats.
Conclusion
The Cyber Resilience Act is a critical step toward improving the security of digital products in the EU, but compliance can be challenging. CRACY simplifies this process by providing a practical, structured approach that benefits all stakeholders. By helping business teams understand their responsibilities, ensuring transparency for customers, and enabling compliance through actionable measures, CRACY makes it easier for organizations to meet CRA requirements.
Whether you’re a manufacturer, importer, distributor, or customer, CRACY ensures that cybersecurity is not just a legal obligation but a shared responsibility. With its focus on clear objectives, practical measures, and transparent communication, CRACY paves the way for a safer and more secure digital future.
We would love to hear from you!
CRACY is supporting European Technology Development companies with security solutions and assessment capabilities to become ready for CRA.
