Cyber Resilience Act (CRA)

1. Appropriate level of security
2. Products to be delivered without known vulnerability
3. Based on the risk and where applicable:
        • Security by default
        • Enable adequate security updates
        • Protection from unauthorized access
        • Confidentiality and integrity of data, commands and programs
        • Minimization of data
        • Availability of essential functions
        • Minimize negative impact on other devices
        • Limit attack surfaces
        • Reduce impact of an incident
        • Record and monitor security relevant events
        • Securely, permanently erase and/or transfer data and settings

        • Identify and document dependencies and vulnerabilities, including SBOM
        • Track vulnerabilities
        • No known vulnerabilities and address vulnerabilities without delay
        • Test the security of the digital product
        • Publicly disclose information about fixed vulnerabilities
        • Coordinated vulnerability disclosure policy
        • Facilitate the sharing of information about potential vulnerabilities
        • Patches are delivered without delay, free of charge and with advisory messages

        • CE marking
        • EU Declaration of Conformity
        • Appointment of authorized representative, designation of a safety point of contact
        • Technical documentation, including cybersecurity risk assessment
        • Information on availability of security updates
        • SBOM covering top-level dependencies
        • Technical documentation defining the support and support period
        • Public SW archive with access to revisions
        • Provide user instruction set
        • Identification of product