Secure by Design Under the CRA: The Essential Requirements

The CRA's Annex I lists essential cybersecurity requirements that every product with digital elements must satisfy. These aren't vague guidelines — they're legally binding conditions for placing products on the EU market.

Security Requirements (Product Properties)

• Risk-appropriate security — Protection level proportionate to the cybersecurity risks
• No known exploitable vulnerabilities — Products must ship without known exploitable vulnerabilities
• Secure default configuration — Security features enabled by default; option to reset to secure state
• Protection against unauthorized access — Authentication, access control, integrity protection
• Confidentiality protection — Encryption of data at rest and in transit where appropriate
• Data integrity — Mechanisms to detect and prevent unauthorized modification
• Data minimization — Process only data necessary for the intended purpose
• Availability and resilience — Design for resilience against denial-of-service attacks
• Minimal attack surface — Reduce the exposure to the extent possible
• Incident impact mitigation — Mechanisms to limit the impact of security incidents
• Security logging — Record relevant security events
• Secure update mechanism — Ability to apply security updates, ideally automatically

Vulnerability Handling Requirements

• Identify and document vulnerabilities and components (SBOM)
• Apply effective patches without undue delay
• Provide free security updates during the support period
• Establish a coordinated vulnerability disclosure policy
• Share relevant information about fixed vulnerabilities

Practical Implementation

Map each requirement to specific technical controls in your product architecture. Document the mapping in your technical file. This documentation is what assessors — or market surveillance authorities — will review.