Luca BertonIf you manufacture IoT devices sold in the EU, the CRA is the most significant regulatory change your product team will face. Default passwords, abandoned firmware, and "ship and forget" practices are no longer legally acceptable.
Key Requirements for IoT
- No default passwords — Each device must ship with a unique password or require the user to set one during first setup
- Secure update mechanism — Devices must support automatic security updates with user notification
- Minimum support period — Security updates must be provided for at least 5 years or the expected product lifetime
- Data minimization — Only collect and process data necessary for the product's function
- Secure by default — Security features enabled out of the box, not opt-in
Design Phase Impact
Threat modeling becomes mandatory, not optional. You must document your risk assessment, security architecture decisions, and how the product handles identified threats. This documentation is part of your technical file for conformity assessment.
Kubernetes Recipes
Practical guide for container orchestration and deployment — hands-on patterns you can use today.
View on Amazon →Supply Chain Obligations
If your IoT device uses third-party components (SoCs, radio modules, firmware libraries), you're responsible for their security. Due diligence on suppliers, component-level vulnerability monitoring, and coordinated disclosure processes are now table stakes.
End-of-Life Planning
You must communicate end-of-support dates clearly to users. When a product reaches end-of-life, users must be informed about the security implications. No more silent abandonment.
Terraform for Beginners
Master Terraform to build scalable infrastructure using IaC principles.
Start on Udemy →