EU CRA TL/DR for PSIRTS - What Product Security Needs To Do To Be Compliant with the CRA
summary
Regulation requires concrete changes: Annex I: 21 requirements forces secure‑by‑design evidence, risk assessments per ENISA, and documented five‑year support windows; manufacturers must produce an ESBOM required on request and be able to deliver patches free and accessible for ten years. Actively exploited issues trigger 72‑hour advisory + 14‑day final report (24‑hour early notice to national CERTs), so expect to rebuild vulnerability handling, SBOM tooling, and upstream contribution workflows before 2026–2027 enforcement.
AI-written summary · about
chapters (39)
- 0:00CRA introduction
- 1:15What is EU CRA
- 3:04EU vs US approaches
- 5:11Digital products scope
- 6:13Manufacturers and stewards
- 7:38CERT CISA terminology
- 9:24Key CRA sections
- 11:51Product teams Annex 1
- 12:34Annex 1 requirements
- 14:20No exploitable vulnerabilities
- 15:48Risk assessments ENISA
- 18:36Vulnerability handling SBOM
- 20:44Remediation timelines upstream
- 23:11Support periods obligations
- 25:00Free updates 10 years
- 27:12Retroactive compliance
- 29:45Testing and disclosure
- 31:53Vulnerability reporting contact
- 34:0124-hour exploit notification
- 37:48Severe incident reporting
- 41:19Non-EU CERT selection
- 43:25Secure updates CE marking
- 44:12Compliance advice resources
- 45:38CRA readiness reports
- 46:41Open source security baseline
- 48:07Crosswalk with frameworks
- 50:12Expert groups standardization
- 52:21Legal CRA CE marking
- 55:58Expert groups role
- 58:29SaaS software scope
- 1:01:05Supply chain obligations
- 1:02:28CRA examples nuances
- 1:04:17Enforcement intent gaps
- 1:07:05EU regulations resources
- 1:09:36Reporting timelines embargo
- 1:11:24Severe incident definition
- 1:14:00Upstream collaboration
- 1:15:50Actively exploited clarification
- 1:17:18Next steps Q&A
related talks
36mThe CRA roadmap: What to expect
27mEU Cyber Resilience Act: What Every Manufacturer Needs to Know
30mThe EU's Cybersecurity Resilience Act (CRA) has Begun – How Can Manufacturers Confidently Addres ...
53mHow To Stay Compliant With and Take Benefits From the EU CRA (Cyber Resilience Act)
42mMaking EU CRA (Cyber Resilience Act) simplified and non-scary for OSS contributors
44mThey're coming to regulate you!
39mCherry Blossom and Compliance - An Intro To the EU CRA
30mRisk, Evidence and Conformity