Cyber Resilience Act (CRA) Standards

This deep-dive session, led by Angelo D’Amato (Founder of Vulnir and rapporteur for CRA standards within CEN/CLC/JTC 13/WG 9), provides a comprehensive technical overview of the security controls being developed to support the Cyber Resilience Act (CRA). The session specifically focuses on the development of prEN 40000-1-4 (Project 2), which defines generic security requirements for products with digital elements.

The Legislative Context of CRA Standards

The development of these standards is driven by the European Commission’s Standardisation Request M/606, which officially mandates CEN, CENELEC, and ETSI to develop harmonized standards in support of Regulation (EU) 2024/2847 (Cyber Resilience Act). The CRA aims to ensure that hardware and software products placed on the EU market have fewer cybersecurity vulnerabilities and that manufacturers remain responsible throughout the product lifecycle.

The standardization strategy employs a two-fold approach:

1. Horizontal Standards: Provide a coherent generic framework, methodology, and taxonomy (e.g., the EN 40000 series).

2. Vertical Standards: Address product-specific risks for categories listed in Annex III of the CRA (e.g., browsers, firewalls, routers).

The Horizontal Standard Interplay

The EN 40000 series forms the core architecture for CRA compliance:

• EN 40000-1-1: Vocabulary.

• EN 40000-1-2 (Project 1): Principles for cyber resilience. This is a process-oriented “catch-all” standard ensuring products are developed and maintained using a risk-based approach.

• EN 40000-1-3 (Project 3): Vulnerability handling requirements. This process standard ensures products are maintained in a secure state throughout their lifetime (CRA Annex I, Part 2).

• EN 40000-1-4 (Project 2): Generic security requirements. This product-oriented standard maps the CRA’s Essential Requirements (ESR) to a catalog of specific security controls.

Deep Dive into Security Controls Framework (PT2)

The primary objective of Project Team 2 (PT2) is to create a technical catalog of security controls that support manufacturers in defining requirements for products in the “default” category and assist in the development of granular vertical standards.

Structure of prEN 40000-1-4

The standard is structured to facilitate a risk-based demonstration of compliance:

• Essential Requirements: Mapping directly to Annex I, Part 1 of the CRA (a–m).

• Security Objectives: High-level goals (e.g., SO.AccessControl) that address specific threats.

• Control Requirements: Technical assessment criteria used to evaluate the implementation of security capabilities.

Alignment with Existing Standards

Rather than reinventing the wheel, PT2 builds upon the EN 18031:2024 series (radio equipment standards) and incorporates elements from IEC 62443-4-2 and ETSI EN 303 645.

Technical Analysis of Essential Security Requirements (ESR)

The session explores several key Essential Requirements through the lens of security objectives and technical controls:

ESR (a): Vulnerability Assessment

Products must be placed on the market without known exploitable vulnerabilities.

• Definition: An “exploitable vulnerability” is one that can be effectively used by an adversary under practical operational conditions.

• Control: Primarily covered by General Equipment Capability GEC-1 (Up-to-date software/hardware).

ESR (b): Secure by Default Configuration

Products must start in a secure state without requiring extensive user configuration.

• Requirements: Deactivating insecure protocols, avoiding default passwords, and providing a factory reset mechanism.

• Mapping: Includes controls for limiting service exposure (GEC-2), documenting exposed interfaces (GEC-4), and secure startup configuration (GEC-9).

ESR (c): Security Updates

Manufacturers must ensure vulnerabilities can be addressed through security updates, including automatic updates by default for consumer products.

• Objectives: Updateability (SO.Updateability), user notification (SO.UserUpdateNotification), and the option to postpone installations (SO.PostponeUpdates).

• Mapping: Covered by the Secure Update Mechanism (SUM) series, including new controls for postponed updates (SUM-4).

ESR (d): Authorized Access

Ensures protection through appropriate authentication and access management systems.

• Gap Identification: A major gap in previous standards was the requirement to report on possible unauthorized access, now addressed by GEC-13.

• Mapping: Utilizes the Authentication Mechanism (AUM) and Access Control Mechanism (ACM) series.

ESR (e) & (f): Confidentiality and Integrity

Requires state-of-the-art encryption for data at rest and in transit, and protection against modification of commands or programs.

• Cryptography: Development is underway for a cross-vertical “Annex K” that defines an “allow list” of cryptographic mechanisms based on ENISA guidelines.

• Controls: Includes Secure Storage (SSM), Secure Communication (SCM), and Confidential Cryptographic Keys (CCK).

Monitoring and Data Deletion (ESR l & m)

Monitoring and Logging (ESR l): Products must record relevant internal activity, such as access to or modification of data.

• Objectives: Recording security-relevant activities (SO.LogSecurityRelevantActivities) and providing a user opt-out mechanism (SO.OptionDisableDataLogging).

• Mapping: Covered by the Logging Mechanism (LGM) and Monitoring (MON) series.

Data Deletion (ESR m): Provides users the ability to securely and easily remove all data and settings permanently, particularly during transfer of ownership.

• Controls: Includes secure data deletion (DLM-1) and integrity protection for exported data (DLM-3).

Timeline and Next Steps

The development of prEN 40000-1-4 is an ongoing process with the following indicative milestones:

• March 2026: Draft standard under development.

• August 2026: Expected delivery of EN 40000-1-2 and EN 40000-1-3.

• October 2026: Delivery of product-specific vertical standards.

• 30 October 2027: Targeted publication date for prEN 40000-1-4 (PT2).