Essential cybersecurity requirements
The binding security requirements set out in Annex I of the CRA, divided into two Parts. Part I specifies 11 security properties that products with digital elements must achieve by design and by default. Part II specifies 8 vulnerability handling obligations that manufacturers must implement as processes throughout the product lifecycle.
Source citations
See also
Structure
Annex I of Regulation (EU) 2024/2847 is divided into two Parts:
Part I — Security requirements for products with digital elements
Products must be designed, developed, and produced to:
- No known exploitable vulnerabilities — shipped free of known exploitable vulnerabilities
- Secure by default — security-relevant defaults; unnecessary capabilities disabled; configuration for secure operation documented
- Confidentiality — data at rest and in transit protected against unauthorised access
- Integrity — protected against manipulation by unauthorised parties
- Restrict attack surface — minimal interfaces and communication channels; surface area justified by functionality
- Resilience — designed to minimise the impact of incidents on other products or networks
- Limit disruption — designed to limit service disruption, including degradation or unavailability
- Secure data handling — collect, process, store only data necessary for intended use; protect data
- Access control — protect against unauthorised access
- Secure update — possibility to install updates, including automatic security updates
- End-user security data — users informed about discovered vulnerabilities; mechanism to securely wipe data before product transfer
Part II — Vulnerability handling requirements (processes)
Manufacturers must have policies and processes to:
- Identify and document vulnerabilities, including maintaining an SBOM
- Address and remediate vulnerabilities without undue delay
- Apply effective and regular testing and reviews of security
- Share information about fixed vulnerabilities on a public advisory
- Maintain a CVD policy
- Facilitate reporting through a single point of contact address
- Provide for secure distribution of security updates
- Provide free security updates for the duration of the support period
Presumption of conformity
Applying a relevant harmonised standard (Art. 27) creates a presumption of conformity with the corresponding essential cybersecurity requirements. Where no harmonised standard exists, the Commission may adopt common specifications (Art. 27(3)).