The CRA roadmap: What to expect
summary
Regulation readiness requires concrete actions: manufacturers must produce SBOM visibility for every device, implement secure update pipelines capable of patching millions of units, and run supply‑chain monitoring tied to CVEs. Expect 30+ standards (many verticals), class1/class2 distinctions, and 24‑hour reporting to EU CERT with 72‑hour follow ups and possible 14/30‑day final reports. No EU notified bodies are appointed as of July 2026, first CRA applicability starts 11 Sept 2026, full applicability by Dec 2027 — fines are materially larger than past directives.
AI-written summary · about
chapters (16)
- 0:00CRA roadmap intro
- 1:09Cyber Security Act context
- 2:33Cyber security compliance challenges
- 5:25CRA compliance beyond tech
- 7:15Process requirements impact
- 9:21SBOM and component management
- 11:07Risk assessment and classification
- 14:00Incident reporting obligations
- 15:49Vulnerability handling risks
- 17:35Compliance routes and standards
- 21:06Horizontal standards implications
- 24:18Standards timeline status
- 26:02Organizational readiness integration
- 29:57Beyond product to org security
- 31:48Notified bodies challenges
- 33:33Industry frameworks compliance
related talks
30mThe EU's Cybersecurity Resilience Act (CRA) has Begun – How Can Manufacturers Confidently Addres ...
54mThe CRA, Where Are We Six Months After Its Approval
22mEU Cyber Resilience Act - A Product Owner’s Approach
27mEU Cyber Resilience Act: What Every Manufacturer Needs to Know
01h 18mEU CRA TL/DR for PSIRTS - What Product Security Needs To Do To Be Compliant with the CRA
44mThey're coming to regulate you!
32mThe EU Cybersecurity Resilience Act (CRA) - Boring, Scary or Exciting?
39mCherry Blossom and Compliance - An Intro To the EU CRA