CRA software requirements for engineers

Product security starts with risk

Annex I sets essential cybersecurity requirements for product properties. The appropriate implementation depends on the product’s cybersecurity risk assessment and intended and reasonably foreseeable use. Evidence should explain the chosen design, not merely list tools.

• Secure-by-default configuration
• Appropriate access control and authentication
• Confidentiality, integrity, and availability protections
• Attack-surface reduction and security logging
• Secure updates and resilience against denial of service

Evidence the released state

For each release, preserve the source revision, build definition, dependency resolution, SBOM, security test output, known issues, approvals, and update artifacts. The aim is to reconstruct what was shipped and the security reasoning applied at that time.

Vulnerability handling is a lifecycle control

Component identification, vulnerability intake, remediation, testing, coordinated disclosure, distribution of security updates, and public disclosure after a fix all form part of a coherent process. That loop is described step by step in CRA vulnerability handling; owners and deadlines should be explicit wherever it runs.

Do not confuse readiness assistance with conformity

Automated evidence collection can identify gaps and maintain technical records. Product classification, applicable harmonised standards, conformity-assessment route, declaration of conformity, and CE marking require accountable manufacturer decisions and, in some cases, a notified body.