Cyber Resilience Act Implementation What companies can expect
1. What is the CRA and why act now?
The Cyber Resilience Act (CRA) has been in effect since December 2024 and, for the first time, mandates binding cybersecurity standards EU-wide for all products with digital elements—from smart home devices and software to industrial controls.
Important deadlines
- From September 2026: Vulnerability reporting obligations begin
- Starting December 2027: Full application of all CRA requirements
What does that mean specifically?
Manufacturers, importers, and distributors must demonstrate that their products have been developed safely, promptly address vulnerabilities, and transparently document which software components are used. Violations may result in fines of up to 15 million euros or 2.51% of annual turnover.
2. Our consulting services: Three central building blocks
We support you in three core areas:
Building block 1: Governance and Risk Management
What is it about?
The CRA requires all connected products to be registered and their risks assessed.
What we work on together:
- Which of your products fall under the CRA? (e.g. software, connected hardware, IoT devices)
- What is your role? (Manufacturer, importer, distributor)
- What product category is this? (Standard, important, critical – determines the testing effort)
- How do we systematically assess cybersecurity risks?
- What safety measures (controls) are required for your products?
Division of labor
- We (Law Firm): Moderate workshops, assess legal requirements, develop risk framework and governance structure
- You (Inhouse): Provide product information, name internal responsible parties, implement technical measures
Result:
Clear roadmap with priorities, risk assessment for your products, definition of security standards
Building Block 2: Software Bill of Materials (SBOM)
What is it about?
The CRA requires a „Software Bill of Materials“ (SBOM) – a machine-readable list of all software components in your product. It's like an ingredients list for food, but for software.
What we work on together:
- Which SBOM format do you use? (CycloneDX or SPDX – international standards)
- What information must be documented? (Component name, version, manufacturer, licenses, security hashes)
- How do you automate SBOM generation in the development process?
- What do you require from your suppliers? (Contractually agree on SBOM delivery obligation)
- When and how do you publish SBOMs? (publicly, on request, only to authorities?)
Division of labor
- We (Law Firm): Define minimum legal requirements, draft contract clauses for suppliers and customers, legally review SBOM content (license compliance, trade secrets)
- You (Inhouse): Select tools, integrate SBOM generation into build processes, maintain component databases
Result:
SBOM process with automated generation, supply chain contract templates, initial sample SBOMs
Building Block 3: Vulnerability Management
What is it about?
The CRA requires structured processes for handling security vulnerabilities: How do you receive reports? How quickly do you respond? How do you inform customers?
What we are building together:
A) Contact Structures
- security.txt file Standardized file on your website with contact details for security researchers (required by CRA)
- Vulnerability website: Central page with all reporting channels, including anonymous web form
- PSIRT and CSIRT Two teams with clear roles:
- PSIRT = Product Security (handles vulnerabilities in your products)
- CSIRT = Corporate Security (handles vulnerabilities in your IT infrastructure)
B) CVD Directive (Coordinated Vulnerability Disclosure)
A published policy explaining to security researchers:
- How do you report vulnerabilities? (Email, web form, encrypted)
- What happens then? (Response times: first response within 5 days, detailed feedback within 10 days)
- When are vulnerabilities published? (Rule: 90 days, extendable)
- What is allowed during testing? (no attacks on third parties, no data theft)
- Are there rewards? (Bug bounty programs are voluntary, but recommended)
BehOrder confirmations
For critical vulnerabilities, you must inform the German CERT-Bund (Federal Office for Information Security's IT emergency team).
- 24 hours First warning
- 72 hours: Detailed report
- 14 days: Final report with solutions
Division of labor
- We (Law Firm): Create CVD policy, define processes, review legal aspects (e.g., when not to file a criminal complaint against a reporter?), assist with CERT-Bund notifications
- You (Inhouse): Set up technical infrastructure (email mailboxes, encryption, ticketing system), process incoming reports, develop security patches
Result:
Published CVD policy, functional reporting channels, trained teams