CRA Essential Cybersecurity Requirements: Secure Design

Does your product have adequate cybersecurity protection when it leaves the factory?

The EU Cyber Resilience Act (CRA) will apply in full from 11 December 2027. The CRA requires manufacturers to build appropriate security measures into the planning, design, development and production phases, based on the product’s cybersecurity risk assessment (Annex I). After the product is placed on the market, they must keep handling vulnerabilities and providing security updates throughout the support period.

🔹 Five security design priorities in CRA Annex I

✅ No known exploitable vulnerabilities: Products must not contain known exploitable vulnerabilities when they are made available on the market. Checking for vulnerabilities before release is one way to achieve this.
✅ Secure by default configuration: Products ship with a secure configuration and can be reset to their original state.
✅ Access control and data protection: Prevent unauthorised access and protect the confidentiality and integrity of data.
✅ Attack surface reduction: Limit unnecessary external interfaces and services to reduce potential attack risks.
✅ Security update mechanism: Ensure vulnerabilities can be fixed through security updates. Where applicable, automatic security updates should be enabled by default, with an option for users to opt out or postpone them.
📝 Note: Annex I Part I contains 13 requirements in total, and the above are five key points among them. It also includes requirements such as data minimisation, resilience against DoS and logging and monitoring, as well as the vulnerability handling requirements in Part II (such as SBOM and a vulnerability disclosure policy). Each requirement is implemented according to the results of the cybersecurity risk assessment and where applicable.

📌 Does your product carry any of these risks?

🏭 Industrial PCs (IPC)
・The same default password is used on every unit shipped
・The BMC remote management interface is enabled by default
・BIOS/firmware updates are installed without digital signature verification
🌐 Networking equipment
・The management interface can be accessed directly from the internet
・Unencrypted management protocols are used
🔋 Energy storage systems (ESS)
・The EMS remote maintenance interface lacks security protection
・Accounts and operating permissions are not managed by privilege level
⚠️ All of these issues can be addressed at the product design stage through clear security requirements and testing mechanisms.
These are examples of common design risks; the CRA text does not name them one by one. Whether they amount to non-compliance must be judged against Annex I based on the product's cybersecurity risk assessment.

💡 How should companies prepare?

📋 Build end-to-end traceability: Turn the CRA Annex I requirements into actionable security requirements and establish the traceability chain "regulatory requirement → security requirement → design implementation → test and verification".
🔗 Build on existing processes: Companies that have already adopted IEC 62443-4-1/4-2 can build on their existing secure development process and product security requirements, then map them against CRA Annex I to fill the gaps, such as SBOM, vulnerability handling, security updates during the support period and the reporting process. Note: IEC 62443 is not currently listed as a CRA harmonised standard, and conforming to it does not give a presumption of conformity with the CRA. CRA harmonised standards are being developed by CEN, CENELEC and ETSI under standardisation request M/606 (some based on EN IEC 62443) and only give a presumption of conformity once cited in the Official Journal.
🎯 Manage from the design stage: CRA compliance is not just about completing cybersecurity tests. What matters more is that security requirements can be managed, verified and traced from the design stage onward.

👉 Want to learn how to turn CRA requirements into actionable security requirements?

Get in touch with Anselm (安盛資訊).

📩 Contact Anselm: sales@anselm.com.tw

Further reading: EU CRA series | Previous article: EU CRA Product Classification and CE Marking: Choosing the Conformity Assessment Route | Next article: EU CRA SBOM: Which Software and Firmware Do Industrial PCs Need to Track?

This article is for general information only and does not constitute legal advice. Official sources: European Commission: CRA standardisation.