Luca BertonNetwork equipment — routers, modems, and switches intended for internet connection — is classified as Important Class I under the CRA and covered by the ETSI standard EN 304 627. This affects everyone from consumer router manufacturers to enterprise networking companies.
Why Network Equipment Is Class I
Routers are the gateway between internal networks and the internet. A compromised router gives attackers access to everything behind it. The history of router botnets (Mirai and its successors) demonstrates the scale of the problem.
Key Requirements
- Unique credentials — Each device ships with a unique admin password. No more admin/admin
- Automatic security updates — Firmware updates must be delivered automatically with user opt-out (not opt-in)
- Secure configuration interface — HTTPS-only management, CSRF protection, session management
- Network segmentation support — Guest network isolation, VLAN support
- DNS security — Support for encrypted DNS (DoH/DoT)
- Logging and monitoring — Security event logging accessible to the user
Kubernetes Recipes
A practical guide for container orchestration and deployment by Grzegorz Stencel & Luca Berton (Apress).
Watch on Skillshare →Enterprise vs. Consumer
The same classification applies to both. Enterprise equipment may have more complex conformity assessment due to additional features, but the essential requirements are identical. Enterprise manufacturers should leverage their existing security certifications as evidence of CRA conformity.