OLKON Consulting’s Post

EU Cyber-Resilience Act The EU's Cybersecurity Regulation (CRA) is a landmark regulation that aims to strengthen cybersecurity in the European market by imposing strict cybersecurity requirements for all digital products and connected devices. This includes hardware, software, and all other products with digital elements that are directly or indirectly connected to a network. The CRA defines products with digital elements as any software or hardware product and its remote data processing solutions that include software or hardware components. The products covered under the CRA must either directly or indirectly connect to a network or device. ⏹️ The act categorizes products into two main groups based on risk levels: 🔹 Non-critical products: These include low-risk hardware and software, such as hard drives, smart home assistants, and connected toys. 🔹 Critical products: These are further divided into Class I (lower risk), such as VPNs and routers, and Class II (higher risk), including operating systems, smart meters, and mobile phones. Critical products are subject to more stringent security measures. Some products, such as medical devices and software-as-a-service (SaaS), are excluded unless part of a larger solution involving digital elements. Importantly, free open-source software used in non-commercial contexts is not covered by the regulation. ⏹️ Key Points: 🔹Cybersecurity by Design 🛡️: Manufacturers will be required to implement security measures from the development stage and maintain them throughout the product's lifecycle. 🔹Lifecycle Obligations 🔄: Manufacturers must provide security updates for up to five years or for the expected lifespan of the product, ensuring vulnerabilities are addressed proactively. 🔹Incident Reporting 📢: Organizations will need to report significant cybersecurity incidents and vulnerabilities within 24 hours to national Computer Security Incident Response Teams. 🔹Global Impact 🌍: The CRA’s requirements extend to non-EU companies that sell products in the EU market, making this regulation a potential global standard for cybersecurity, influencing businesses worldwide. The CRA is expected to be fully enforced by 2027, following a transition period after its anticipated adoption in early 2024. This regulation will enhance Europe’s cyber resilience and set a global benchmark for digital product security. #OLKON #Cybersecurity #Regulation

To view or add a comment, sign in

Explore topics