Luca BertonOperating systems are the foundation of digital security. The CRA classifies commercial OS products as Important Class I under EN 304 626, requiring either harmonized standard compliance or third-party assessment.
Who's Affected
- Microsoft Windows — Full CRA manufacturer obligations
- Apple macOS/iOS — Full CRA obligations for EU market
- Commercial Linux distributions — RHEL, SUSE, Ubuntu Pro
- Chrome OS — Full obligations
- Android — Google as manufacturer; OEMs have additional obligations
Community Linux Distributions
Non-commercial distributions (Debian, Arch, Fedora community edition) fall outside CRA scope as non-commercial FOSS. However, when a company packages and sells a commercial product based on these (e.g., Ubuntu Pro, RHEL from Fedora), the commercial product is in scope.
Kubernetes Recipes
A practical guide for container orchestration and deployment by Grzegorz Stencel & Luca Berton (Apress).
Watch on Skillshare →Key OS-Specific Requirements
- Secure boot chain with integrity verification
- Kernel hardening and exploit mitigations
- Mandatory access control frameworks
- Automated security patch delivery
- Application isolation (sandboxing, containerization)
- Encrypted storage by default
Support Period Considerations
The CRA requires security updates for at least 5 years. This aligns well with enterprise Linux support cycles (RHEL: 10 years, Ubuntu LTS: 5 years) but may challenge consumer OS vendors who historically dropped support earlier.
Automating IT Infrastructure with Ansible
Learn Ansible to automate IT operations and enhance system reliability.
Start on Udemy →