Cyber Resilience Act · Regulation (EU) 2024/2847
Cyber Resilience Act for products with digital elements.
The CRA sets cybersecurity requirements for hardware and software products sold in the EU, across their whole life cycle. With Basenorm you organise the processes behind them, such as vulnerability handling and supplier security, on your ISO 27001 ISMS.
Hosted in the Netherlands. Your data stays in the EU.In brief
- Type
- EU regulationIn force since 10 December 2024
- Applies to
- Products with digital elementsManufacturers, importers and distributors
- Reporting
- From 11 September 2026Actively exploited vulnerabilities and severe incidents
- Main obligations
- From 11 December 2027Including conformity assessment and CE marking
01 / What the CRA asks
What the CRA
asks of you.
The CRA applies to the product and to the processes of the manufacturer, for the whole support period of the product.
- 1Security by design
Meet the essential cybersecurity requirements of Annex I when you design and build the product.
- 2Vulnerability handling
Identify and fix vulnerabilities, with a software bill of materials and coordinated disclosure.
- 3Security updates
Provide security updates for the support period of the product.
- 4Reporting
Report actively exploited vulnerabilities and severe incidents, with an early warning within 24 hours.
- 5Conformity assessment
Assess conformity and affix the CE marking before you place the product on the market.
- 6Technical documentation
Document how the product meets the requirements.
Some products follow sector-specific rules or a stricter conformity assessment.
02 / With your ISMS
the CRA on what you already have.
| Topic | Your ISO 27001 ISMS | What the CRA adds |
|---|---|---|
| Secure development | Secure development life cycle controls | Essential cybersecurity requirements per product |
| Vulnerabilities | Technical vulnerability management | A software bill of materials, coordinated disclosure and security updates |
| Reporting | Incident management | A 24-hour early warning for actively exploited vulnerabilities |
| Suppliers | Supplier relationship controls | Due diligence on third-party components, including open source |
ISO 27001 covers your organisation. The CRA adds requirements per product, which you evidence in the technical documentation.
03 / Key dates
REGULATION (EU) 2024/2847The CRA
step by step.
The CRA applies in phases, so manufacturers have time to adapt their products and processes.
Read about ISO 27001In force. The regulation entered into force.
Reporting obligations. Reporting of actively exploited vulnerabilities and severe incidents applies.
Full application. The other obligations, including conformity assessment, apply.
Source: Regulation (EU) 2024/2847.
04 / In Basenorm
How Basenorm supports you.
Unified Control Library
See which ISO 27001 controls support your CRA processes.
02Governance Graph
Connect products, components, suppliers, vulnerabilities and owners.
03AskNorman
Ask what is still open for the CRA, in Basenorm or via MCP from ChatGPT, Claude or Perplexity. You review the evidence yourself.
05 / Questions
Questions about
the CRA.
Does the CRA apply to us?
If you place hardware or software products with digital elements on the EU market, it probably does. Pure software as a service is generally outside its scope, unless it is remote data processing that a product needs to function.
Is ISO 27001 enough for the CRA?
Not on its own. ISO 27001 covers your organisation, while the CRA sets requirements per product, such as essential requirements, a software bill of materials and CE marking.
What is a software bill of materials?
A list of the components in a product. The CRA requires manufacturers to draw one up as part of the technical documentation.
Does Basenorm do the conformity assessment?
No. Basenorm helps you organise processes, controls and evidence. The conformity assessment is done by you or, for certain products, by a notified body.
Book a demo
Organise the CRA on your ISO 27001.
In a demo we look at your products, your processes and what the CRA adds.
- Which ISO 27001 controls support the CRA.
- How you organise vulnerability handling and suppliers.
- How you keep evidence per product.
Hosted in the Netherlands. Your data stays in the EU.