Cybersecurity
Cybersecurity Risk Assessment
Comprehensive cybersecurity risk assessment for industrial control systems and connected products.
Learn More
Cybersecurity Standard
CRA
EU Cyber Resilience Act (CRA) - Regulation (EU) 2024/2847
Official DocumentationOverview
The EU Cyber Resilience Act (CRA) establishes mandatory cybersecurity requirements for products with digital elements marketed in the EU. It introduces product categories (Default, Important I & II, Critical) with different compliance requirements and costs (Default: €10K-25K, 8-10 weeks). The CRA includes harmonized standards EN 40000 series (40000-1-1 vocabulary, 1-2 principles, 1-3 vulnerability handling) and mandates a comprehensive vulnerability handling process (PRE/RCP/VRF/RMD/RLS/PRA phases). Full implementation starts 2027-12-11 with vulnerability reporting obligations from 2026-09-11.
Scope
Applies to hardware and software products with digital elements that are directly or indirectly connected to another device or network. Covers both consumer and professional products.
Key Requirements
1 Cybersecurity risk assessment
2 Secure by design and development
3 Vulnerability handling and disclosure
4 Security updates and patches
5 Technical documentation
6 EU Declaration of Conformity
7 Conformity assessment procedures
8 Post-market monitoring
9 Incident reporting obligations
10 CE marking for cybersecurity
Target Audience
Hardware manufacturers exporting to EU
Software developers and vendors
IoT device manufacturers
Product compliance managers
Importers and distributors
Digital service providers
Related Services
We provide the following professional consulting services related to CRA
Cybersecurity
Security by Design
Integrate security into your product development lifecycle from concept to deployment.
Learn More
Cybersecurity
EU CRA Compliance
Navigate the EU Cyber Resilience Act requirements and achieve compliance for your products.
Learn More
Cybersecurity
Vulnerability Disclosure & Management
Establish processes for vulnerability disclosure, handling, and coordinated vulnerability response.
Learn More
Free Templates
Free DownloadGet free document templates for CRA. Leave your contact information and we'll send the templates to your email, along with our full catalog.
Get Free Templates
We typically send templates within 24 hours
Related Articles
Deepen your understanding of CRA with these articles and best practices
Cybersecurity March 14, 2026
CRA in 5 Minutes: Understanding the EU Cyber Resilience Act
The EU Cyber Resilience Act (CRA) will be fully implemented in 2027, affecting all connected products exported to the EU. Learn the core requirements, timeline, and compliance strategies in just 5 minutes.
5 min read
Cybersecurity March 14, 2026
CRA Product Classification: Understanding Default vs Important vs Critical
Product classification is the first step in CRA compliance. Master the Default category principles to choose the correct compliance path for your product. 90%+ of products belong to Default category with €10K-25K cost.
8 min read
Cybersecurity March 14, 2026
CRA Compliance FAQ: 10 Most Common Questions Answered
Comprehensive FAQ covering product scope, classification, compliance paths, Module A requirements, vulnerability handling, and timelines. Essential reading for manufacturers exporting to the EU.
10 min read
Cybersecurity March 14, 2026
CRA Impact on New Energy Industry: From ESS to EV Chargers
CRA has profound implications for the new energy industry. ESS, inverters, and EV chargers face new cybersecurity compliance requirements. Most products belong to Default category with Module A path.
8 min read
Cybersecurity March 14, 2026
Vulnerability Handling Six-Step Method: Ensuring Product Security Throughout Lifecycle
CRA requires a comprehensive vulnerability handling process throughout the product lifecycle. Detailed explanation of EN 40000-1-3 six-phase methodology: PRE, RCP, VRF, RMD, RLS, PRA.
10 min read
Need CRA Compliance Support?
Our expert team provides comprehensive compliance consulting and certification support
Other Standards
Explore other functional safety and cybersecurity standards we support
IEC 61508