15.01.2025 00:20:00
Дата публикации
The Cyber Resilience Act (CRA) has come into force in the European Union, aimed at increasing the level of protection for users and businesses from cyber threats. This is the first regulation in the history of the EU that establishes mandatory requirements for the security of products with digital elements.
The CRA tightens the responsibility of manufacturers for ensuring the security of hardware and software. Now companies are required to provide updates to eliminate vulnerabilities and guarantee security support for five years after the product is released.
Manufacturers are also required to conduct risk assessments and report identified vulnerabilities and incidents. For users, the law's measures mean increased transparency and the ability to make a more informed choice among products on the market.
Products that meet the requirements of the law will be marked with the CE mark, which confirms their compliance with EU standards. The deadline for full implementation of the key provisions of the CRA is set for December 11, 2027.
Particular attention is paid to Internet of Things (IoT) devices, biometric scanners and surveillance cameras. High-risk products such as antivirus and VPN services will require mandatory auditing by a certified organization.
Manufacturers have 21 months to start reporting cyber incidents and 36 months to bring their products into compliance. These deadlines are intended to ensure a smooth transition to the new standards.
Previously, such measures were applied only to products from the automotive, medical and aerospace industries.
According to the Executive Vice-President of the European Commission Henna Virkkunen, the law strengthens user trust in digital products and makes Europe safer for life and business.
The CRA complements the previously adopted NIS2 framework, strengthening the EU's comprehensive approach to ensuring cybersecurity. This is another step towards creating a secure digital space.
(the text is translated automatically)
The CRA tightens the responsibility of manufacturers for ensuring the security of hardware and software. Now companies are required to provide updates to eliminate vulnerabilities and guarantee security support for five years after the product is released.
Manufacturers are also required to conduct risk assessments and report identified vulnerabilities and incidents. For users, the law's measures mean increased transparency and the ability to make a more informed choice among products on the market.
Products that meet the requirements of the law will be marked with the CE mark, which confirms their compliance with EU standards. The deadline for full implementation of the key provisions of the CRA is set for December 11, 2027.
Particular attention is paid to Internet of Things (IoT) devices, biometric scanners and surveillance cameras. High-risk products such as antivirus and VPN services will require mandatory auditing by a certified organization.
Manufacturers have 21 months to start reporting cyber incidents and 36 months to bring their products into compliance. These deadlines are intended to ensure a smooth transition to the new standards.
Previously, such measures were applied only to products from the automotive, medical and aerospace industries.
According to the Executive Vice-President of the European Commission Henna Virkkunen, the law strengthens user trust in digital products and makes Europe safer for life and business.
The CRA complements the previously adopted NIS2 framework, strengthening the EU's comprehensive approach to ensuring cybersecurity. This is another step towards creating a secure digital space.
(the text is translated automatically)
