The Cyber Resilience Act applies to hardware and software placed on the EU market that can connect to a network or another device, which covers almost every IoT product. Manufacturers must design products with security in mind, ship them without known exploitable vulnerabilities or default passwords, provide security updates for a defined support period, maintain a software bill of materials, run a vulnerability disclosure process and report actively exploited vulnerabilities to the authorities. Conformity is shown through CE marking, with third-party assessment for product classes judged higher risk.
For companies that treated security as a post-launch concern, the CRA changes the economics: the support obligation and reporting duties have to be budgeted at design time. IoT security regulation compares it with the UK and U.S. approaches.
Part of the IoT Glossary. Spotted an error or a missing term? Tell us.