The latest developments of the CRA: what a CISO needs to know

This Proposal of the CRA is currently in full swing. The last version was published with changes on August 31, 2023. We list in a nutshell some latest additions that are relevant for every CISO:

1. Remote processing or storage
   The definition of products with digital elements also includes remote data processing solutions to ensure that such products are adequately secured in their entirety by their manufacturers, irrespective of whether data is processed or stored locally on the user’s device or remotely by the manufacturer. The processing or storage at a distance is covered only in so far as necessary for a product with digital elements to perform its functions. This could for instance be the case where a hardware device requires access to an application programming interface or a database developed by the manufacturer. The requirements concerning the remote data processing solutions under the scope of this Regulation do not therefore entail technical, operational, and organisational measures aimed at managing the risks posed to the security of their network and information systems as a whole.

2. No stricter security requirements
   In line with the objective of this Regulation to remove obstacles to the free movement of products with digital elements, Member States cannot impose further cybersecurity requirements for the making available on the market of products with digital elements.

3. Commercial activity
   This Regulation applies only to products with digital elements in the course of a commercial activity. The supply might be characterized not only by charging a price for a product, but also by charging a price for technical support services when this does not serve only the recuperation of actual costs or pursues a profit or the intention to monetize, by providing a software platform through which the manufacturer monetizes other services, or by requiring as a condition for use, the processing of personal data for reasons other than exclusively for improving the security, compatibility or interoperability of the software. The circumstances under which the product has been developed, or how the development has been financed should not be taken into account when determining the commercial or non-commercial nature of that activity.

4. Newly available security updates
   One of the most important measures for users to take in order to protect their products with digital elements from cyberattacks is to install the latest available security updates as soon as possible. Manufacturers should therefore design their products and create processes to ensure that products with digital elements include functions that enable the notification, distribution, download, and installation of security updates automatically. They should also provide the possibility to approve the download and installation of the security updates as a final step, as well as clear instructions on how users can opt out of automatic updates.

5. Integration of third-party components
   When integrating components sourced from third parties in products with digital elements during the design and development phase, manufacturers should exercise due diligence. The appropriate level of due diligence measures should be informed by the nature and level of the cybersecurity risk associated with the component and, for this purpose, take into account specific factors, such as the way in which the component contributes to the functionality of the product and the extent to which it has access to data processed by the product with digital elements.

6. Essential requirements applicable to each individual product
   Essential requirements, including vulnerability management handling requirements, apply to each individual product with digital elements when placed on the market, irrespective of whether the product with digital elements is manufactured as an individual unit or in series.

7. Justification in the risk assessment
   Where certain essential requirements are not applicable to a product with digital elements, the manufacturer should include a clear justification in the cybersecurity risk assessment included in the technical documentation. This could be the case where an essential requirement would be incompatible with the nature of a product with digital elements. For example, specific interoperability requirements. 

8. The concept of expected lifespan
   Manufacturers should determine the expected product lifetime. To that end, they should take into account the time users reasonably expect to be able to use the product with digital elements given its functionality and intended purpose and therefore can expect to receive security updates. In addition, they should also be able to take into account other elements, such as:

• relevant Union law determining the lifetime of products with digital elements
• the nature of the product with digital elements, including the licensing terms under which it is made available.
• the expected availability of the operating environment the product with digital elements is intended for; the lifetime of products with digital elements offering a similar functionality placed on the market by other manufacturers, including, where available, relevant guidance provided by market surveillance authorities.
• as well as the lifetime of integrated components that provide core functions and are sourced from third parties.