Cyber Resilience Act: The Impact on IoT Manufacturers

The Cyber Resilience Act (CRA) is the European regulation that will transform digital product security. Adopted in late 2024, it imposes mandatory cybersecurity requirements on all products with digital elements sold in the EU for the first time. IoT manufacturers are on the front line.

What the CRA Requires from Manufacturers

Mandatory Security by Design

No more firmware with hardcoded passwords and open ports by default. The CRA mandates:

• No known vulnerabilities at the time of market placement

• Secure default configuration: no default credentials, encryption enabled

• Minimized attack surface: only necessary ports and services

• Data integrity protection for stored and transmitted data

• Logging of relevant security events

SBOM: The Cornerstone of Transparency

Every manufacturer must provide a Software Bill of Materials (SBOM) listing all software components in their product, including open-source libraries. The SBOM must be made available to market surveillance authorities and generated in a machine-readable format (SPDX or CycloneDX).

This is a game changer. When a critical vulnerability is discovered in a library like Log4j, the SBOM allows immediate identification of all affected products. ThreatClaw integrates SBOM generation and analysis into its monitoring pipeline.

Security Updates for at Least 5 Years

The CRA requires manufacturers to provide free security updates throughout the expected product lifetime, with a minimum of 5 years. Patches must be deployed without undue delay and automatically where possible.

Vulnerability Notification: 24h to ENISA

Manufacturers must report any actively exploited vulnerability to ENISA within 24 hours, with a detailed report within 72 hours. User notification must follow without unjustified delay.

CE Marking Extended to Cybersecurity

CE marking, previously associated with physical safety and electromagnetic compatibility, will now include cybersecurity compliance. A connected product that does not comply with the CRA can no longer be sold in the EU.

Products are classified into categories:

• Default: manufacturer self-assessment

• Class I (password managers, VPNs, home routers): self-assessment with harmonized standards or third-party audit

• Class II (firewalls, HSMs, operating systems): mandatory third-party audit

• Critical (security components for essential infrastructure): European certification

Timeline and Penalties

Vulnerability notification obligations apply from September 2026. Full requirements take effect in December 2027. Penalties can reach 15 million euros or 2.5% of global turnover.

How to Prepare Now

• Implement an automated SBOM generation process

• Audit the security posture of your connected products

• Implement a vulnerability management process (discovery, triage, remediation)

• Plan a secure update mechanism (signed OTA)

• Train your teams on the secure development lifecycle

Discover our expertise and plans to support your CRA compliance journey.

FAQ

Does the CRA apply to open-source software?

Non-commercial open-source software is exempt. However, a commercial product integrating open source is subject to the CRA. Open-source "stewards" have lighter documentation obligations.

What is an SBOM and why does it matter?

A Software Bill of Materials is the complete list of software components in a product. It enables rapid identification of products affected by a vulnerability in a third-party component.

Are products already on the market affected?

Yes, if the manufacturer continues to sell them or provide updates after the regulation takes effect. End-of-life products must be clearly identified.

How does the CRA interact with GDPR?

The CRA complements GDPR. Personal data protection is part of the CRA's essential requirements. A product non-compliant with the CRA is likely also in GDPR breach.