Cyber Resilience Act Sets New Cybersecurity Standards for Digital Products

Overview

The Cyber Resilience Act, established by the European Parliament and Council, introduces comprehensive regulations for the marketing of products with digital elements, emphasizing essential cybersecurity requirements for economic operators.

This regulation targets products connected to devices or networks, with exceptions for items governed by specific EU legislation, such as medical devices and defense equipment.

Key Obligations for Manufacturers

Manufacturers are tasked with several critical responsibilities, including cybersecurity risk assessment, maintaining technical documentation, and ensuring vulnerability management. They must conduct thorough evaluations of potential cybersecurity risks, keep comprehensive records to demonstrate compliance, and ensure products are free from known exploitable vulnerabilities while providing timely security updates. Additionally, manufacturers are required to report actively exploited vulnerabilities and significant incidents to Computer Security Incident Response Teams (CSIRTs) and the European Union Agency for Cybersecurity (ENISA).

Responsibilities of Economic Operators

The Act outlines specific obligations for authorized representatives, importers, and distributors, emphasizing collaboration with market surveillance authorities and the provision of necessary compliance information.

Implementation Timeline

Published on October 23, 2024, the Cyber Resilience Act will take effect 20 days after publication in the Official Journal of the European Union, with full enforcement scheduled for October 23, 2027. Certain obligations, such as vulnerability notifications and conformity assessment body designations, will begin earlier—21 months and 18 months post-publication, respectively.

Conformity and CE Marking

Products meeting harmonized standards or common specifications will be presumed compliant with essential cybersecurity requirements. Each product model must have a corresponding declaration of conformity.

Specific guidelines for affixing the CE marking include requirements for visibility and legibility, size of the marking, timing of affixing, and identification of notified bodies. The CE marking must be affixed in a visible, legible, and indelible manner. If impractical on the product itself, it can be placed on packaging or the accompanying EU declaration of conformity. The marking may be less than 5 mm in height, provided it remains visible. It must be attached before the product is placed on the market and can be supplemented by pictograms indicating special cybersecurity risks. If a notified body is involved, their identification number must be included.

The Cyber Resilience Act aims to fortify the cybersecurity framework for digital products, enhancing the protection of consumers and stakeholders across the European Union.

Link to Source

View the full document - https://data.consilium.europa.eu/doc/document/PE-100-2023-REV-1/en/pdf