What Are the Key Requirements of the Cyber Resilience Framework?
The Cyber Resilience Act (Regulation (EU) 2024/2847), in force since 10 December 2024, is the first EU law that sets cybersecurity rules for products themselves. To be sold on the EU market, any connected digital hardware or software, such as routers, cameras, apps or firmware, must meet its requirements.
Since 11 September 2026, reporting actively exploited vulnerabilities and severe incidents is mandatory, including for older products still in use after their support period has ended. Manufacturers report them to ENISA and the national CSIRT via ENISA’s Single Reporting Platform.
Next phase arrives on 11 December 2027, when every product must meet the essential requirements below. Once you have proven this, you sign an EU declaration of conformity and put the CE mark on the product. Without it, the product cannot be sold in the EU.
From Secure Design to Vulnerability Management
The CRA’s essential requirements from Annex I boil down to two parts:
Part I – Product Features: This refers to how is the product designed, developed and manufactured. These requirements must be met by the product at the time of release, such as secure by design and by default, launch with no known vulnerabilities and protect data and access with encryption.
Part II – Vulnerability Management: This refers to what the manufacturer does throughout the support period: looking for vulnerabilities, fixing them, and releasing updates. This means, the manufacturer's responsibility does not end with the sale.
Even a product that is completely secure when it is launched will have new vulnerabilities in a few months, as new attacks and component defects appear. Therefore, the manufacturer must maintain security throughout its entire life cycle. To read a full list of CRA essential requirements visit cyberresilienceact.eu.
The security requirements apply to all products, but the CRA sorts them into risk tiers that decide how you prove compliance:
- Default (about 90% of products, e.g. common apps, simple IoT devices): self-assessment by the manufacturer.
- Important, class I (e.g. browsers, VPNs, operating systems, routers, smart locks): self-assessment only if you apply harmonised standards, common specifications or an EU certification scheme, otherwise a third party.
- Important, class II (e.g. hypervisors, firewalls, IDS/IPS): assessment by a third party (notified body).
- Critical (e.g. hardware security modules, smart meter gateways, smart cards): third party, possibly mandatory EU certification.
For each tier you need records to prove compliance.
When Does a CRA Reporting Obligation Apply?
Reporting is the part of the CRA that already applies. Many organizations know the 24/72-hour rhythm from NIS2, which covers their own networks and services. The CRA applies the same logic to the products they make and sell. What triggers a report? Sort every security finding into one of three situations:
- Common vulnerability: no report. A flaw nobody is exploiting. Even a CVSS score of 9.8 doesn’t trigger a report on its own.
- Actively exploited vulnerability: report. There is reliable evidence of abuse, such as logs, a CSIRT alert or a customer’s confirmation.
- Severe incident: report. An event that compromises the product’s security or spreads malicious code, such as a hacked update server pushing malware.
Reports go through ENISA’s Single Reporting Platform (in Czechia, to the Government CERT at NÚKIB). early warning within 24 hours, a notification within 72 hours, then a final report.
Who Is Affected by the Cyber Resilience Act?
The CRA’s obligations, from reporting to the CE mark, fall on manufacturers, and on importers and distributors who sell under their own brand or substantially modify a product. Inside the company, it involves management (fines), security teams (deciding and reporting), product and engineering (fixes and updates), the service desk (often the first to get an alert) and compliance (NIS2 and GDPR overlaps).
How Can ALVAO Support Your CRA Compliance Process?
ALVAO already helps organizations comply with NIS2, and the CRA is a new building block on top of it. They both rely on one intake, a clear owner, a timer and a record. Part II of CRA is where most organizations struggle, because it demands processes that run reliably for years. That’s where ALVAO helps:
- Risk assessment: evaluate assets, threats and risks, and keep the assessment up to date.
- Vulnerability intake: reports from researchers, customers and CSIRTs land in one Service Desk queue.
- Fast remediation: SLA timers make sure every vulnerability is fixed without delay.
- Component visibility: asset inventory shows where affected software runs.
- Reporting: deadline timers for the 24h and 72h reports, plus a full audit trail.
CRA requirement How ALVAO helps Spot reportable events fast
Security mailbox, customer reports and CSIRT alerts land in one Service Desk queue, not personal inboxes.
Meet the 24h and 72h deadlines
A dedicated ticket type with SLA timers and automatic escalation via Teams and Outlook.
Find affected products and devices
HW/SW inventory in Asset Management shows where a vulnerable component runs.
Assess risks across the lifecycle
Evaluate assets, threats and risks and keep the assessment up to date.
Prove what you did
A full audit trail of when you learned about the event, who decided and why.
Ready to simplify your compliance processes? See how ALVAO supports vulnerability reporting, risk assessment and auditability.
This article was written by Alexandra Märtzová, Information Security Compliance Specialist at ALVAO. She focuses on cybersecurity and compliance, with a passion for keeping data and digital environments safe and secure.
FAQ
What is the Cyber Resilience Act (CRA)?
The Cyber Resilience Act is an EU regulation that sets cybersecurity requirements for products with digital elements, including connected hardware and software. It covers both product security and vulnerability management throughout the product lifecycle.
When does the Cyber Resilience Act apply?
The CRA entered into force on 10 December 2024. Reporting obligations for actively exploited vulnerabilities and severe incidents apply from 11 September 2026, while the main CRA requirements apply from 11 December 2027.
Who needs to comply with the Cyber Resilience Act?
CRA obligations primarily apply to manufacturers. They can also apply to importers and distributors, including those that market a product under their own name or trademark or substantially modify a product.
What cybersecurity requirements does the CRA introduce?
The CRA covers two main areas: security requirements for products and vulnerability management. Manufacturers need to address cybersecurity when designing and developing products and continue managing vulnerabilities and security updates throughout the support period.
How can ALVAO support CRA compliance?
ALVAO can support the operational processes behind CRA compliance, including vulnerability intake, risk assessment, remediation tracking, asset and software visibility, reporting deadlines and audit trails. This helps organizations maintain records of vulnerabilities, responsibilities, decisions and remediation activities.