Framework library · European Union

Cyber Resilience Act

CRA — Cyber Resilience Act. Published by European Parliament & Council; ENISA + national market-surveillance authorities, version Regulation (EU) 2024/2847. Kapālins maps it to 6 controls. 5 of 6 controls are proved by a live signal from the platform, and 1 by the assessment.

Read the source document

Controls mapped
CRA-CONFORMITYRisk assessment, technical documentation & conformity assessmentAssessment
CRA-DILIGENCEDue diligence on third-party componentsLive signal
CRA-ERQEssential cybersecurity requirements (product properties)Live signal
CRA-REPORTReporting actively exploited vulnerabilities & severe incidentsLive signal
CRA-SUPPORTSupport period & security updatesLive signal
CRA-VULNVulnerability handling & software bill of materialsLive signal

Live signal: a signal from the gateway, probes or device sensor proves it continuously. Assessment: it is evidenced by answers to the assessment. Both are exported in the regulator evidence pack.

History

How the Cyber Resilience Act got here.

  1. Proposed

    The Commission proposed the Cyber Resilience Act. European Commission

  2. Adopted

    Regulation (EU) 2024/2847 adopted; published in the Official Journal on 20 November 2024. EUR-Lex

  3. In force

    The Cyber Resilience Act entered into force. EUR-Lex

  4. In force

    Chapter IV on notification of conformity assessment bodies applies. EUR-Lex

  5. In force

    Article 14 reporting obligations for actively exploited vulnerabilities and severe incidents apply. EUR-Lex

  6. In force · upcoming

    The Cyber Resilience Act applies in full. EUR-Lex

See this framework on your estateAll 29 frameworks