The CRA establishes cybersecurity requirements for products with digital elements marketed in the European Union. It places greater emphasis on secure product development, vulnerability management, cybersecurity transparency, and continuous support throughout the product lifecycle. While the legislation primarily applies to manufacturers, the regulations will also affect organizations that distribute, install, acquire, and manage connected devices.

“The Cyber ​​Resilience Act reinforces many of the security-by-design and lifecycle management principles that Genetec has championed for years,” said Mathieu Chevalier, Principal Security Architect at Genetec. “By raising expectations for product security and transparency, the CRA regulation provides buyers with a clear basis for evaluating technology providers and the long-term cyber resilience of their products.”.

For how long will the product receive security updates and technical support?
The CRA emphasizes the importance of maintaining product security throughout its entire lifecycle. Security professionals need to know how long the vendor will provide updates, how it will address vulnerabilities, and what support it will offer when products reach end-of-life. CRA regulations require manufacturers to provide security updates and vulnerability management for at least five years, making long-term support an important factor to consider when evaluating products.

Has cybersecurity been integrated into the product from the outset?
The principles of "Secured by Design" and "Secure by Default" are fundamental to CRA. It is advisable to ask the vendor to explain how they incorporate cybersecurity into the design, development, testing, and ongoing lifecycle of the product.

How does the vendor identify, disclose, and address vulnerabilities?
No software is immune to vulnerabilities. A vendor's response is a clear indicator of its commitment to cybersecurity. Look for a robust vulnerability management program that includes regular security testing, a coordinated vulnerability disclosure policy, risk-based remediation without undue delay, secure distribution of security updates, and clear notifications about patched vulnerabilities.

Is the vendor transparent about its own cybersecurity practices?
Cybersecurity is a shared responsibility. Responsible vendors explain how they develop, test, and maintain their products, and provide customers and integrators with clear guidance for secure implementation. It's advisable to ask how the vendor regularly checks and reviews product security, communicates vulnerabilities and security updates, and provides guidance for hardening system security.

“Organizations best prepared to manage future cyber threats view cybersecurity as an ongoing collaboration, not a one-off acquisition decision,” Chevalier concluded. “The CRA helps reinforce that approach by establishing common expectations for transparency, disciplined vulnerability management, and long-term technical support for products, which benefits manufacturers, integrators, and organizations that rely on connected physical security systems.”.