The EU's Cybersecurity Resilience Act (CRA) has Begun – How Can Manufacturers Confidently Addres ...
summary
The EU CRA applies to any product with a digital element sold in the EU and imposes Sep 11, 2026 reporting start plus full manufacturer obligations by Dec 11, 2027. Reporting requires 24h early warning, 72h vulnerability notice, 14‑day final report (incident timelines can extend), products fall into default/class1/class2/critical, and conformity uses modules A, B+C or H with Notified Bodies surfacing from August 2026. Practical steps: map stakeholders, run tabletop exercises, run gap assessments and PSIRT-driven playbooks; one vendor finds >32 process fixes after exercises.
AI-written summary · about
chapters (12)
- 0:00EU Cyber Resilience Act intro
- 1:49CRA challenges for manufacturers
- 3:39Compliance deadlines
- 6:07Reporting obligations
- 11:11Stakeholder coordination
- 16:53Tabletop exercises
- 18:41Cyber intelligence platforms
- 19:46Manufacturer obligations
- 23:23Product categorization
- 27:15Notified bodies requirements
- 28:40Compliance takeaways
- 29:22Q&A
related talks
27mEU Cyber Resilience Act: What Every Manufacturer Needs to Know
22mEU Cyber Resilience Act - A Product Owner’s Approach
32mThe EU Cybersecurity Resilience Act (CRA) - Boring, Scary or Exciting?
33mImplementing the EU Cyber Resilience Act (CRA)
36mThe CRA roadmap: What to expect
44mThey're coming to regulate you!
39mCherry Blossom and Compliance - An Intro To the EU CRA
53mHow To Stay Compliant With and Take Benefits From the EU CRA (Cyber Resilience Act)