Luca BertonOne of the most practical developments under the CRA is ETSI's work on vertical standards. The ETSI TC Cyber Working Group EUSR is leading the development of 18 CRA product standards that will define specific cybersecurity requirements for different product categories.
Why Vertical Standards Matter
The CRA sets broad essential requirements. Vertical standards translate these into specific, testable criteria for each product type. For Important Class I products, compliance with a harmonized standard provides a presumption of conformity — meaning you can self-assess instead of paying for third-party audits.
The 18 Standards
Important Products — Class I
- EN 304 617 — Browsers
- EN 304 618 — Password Managers
- EN 304 619 — Antivirus software (searches, removes, or quarantines malicious software)
- EN 304 620 — Virtual Private Networks (VPNs)
- EN 304 621 — Network Management Systems (NMS)
- EN 304 622 — Security Information and Management Systems (SIEM)
- EN 304 623 — Boot Managers
- EN 304 624 — Public Key Infrastructures (PKI) and digital certificate issuance software
- EN 304 625 — Physical and virtual network interfaces
- EN 304 626 — Operating Systems (OS)
- EN 304 627 — Routers, modems intended for internet connection, and switches
- EN 304 631 — Smart home general purpose virtual assistants
- EN 304 632 — Smart home products with security functionalities
- EN 304 633 — Internet connected toys
- EN 304 634 — Personal wearable products
Important Products — Class II
- EN 304 635 — Hypervisors and container runtime systems
- EN 304 636 — Firewalls, intrusion detection and/or prevention systems
Critical Products
- EN 304 642 — Network functions of telecommunications systems
Kubernetes Recipes
Practical guide for container orchestration and deployment — hands-on patterns you can use today.
View on Amazon →Timeline and Adoption
These standards are currently in development. Once harmonized (published in the EU Official Journal), they become the reference for conformity assessment. Organizations developing products in these categories should monitor ETSI's progress and begin aligning their development practices now.