Luca BertonEN 304 642 covers network functions of telecommunications systems — the only CRA standard in the Critical category. These products require European cybersecurity certification, the most rigorous assessment path under the CRA.
What's Classified as Critical
Network functions that form the backbone of telecommunications infrastructure:
- 5G core network functions (AMF, SMF, UPF, NRF)
- Virtualized network functions (VNFs) and cloud-native network functions (CNFs)
- Network function virtualization infrastructure (NFVI)
- Software-defined networking controllers for telecom
- Subscriber data management systems
Certification Requirements
Unlike Class I (self-assessment possible) and Class II (third-party assessment), Critical products require certification under an EU cybersecurity certification scheme developed under the Cybersecurity Act (Regulation 2019/881). This means:
- Assessment by an accredited conformity assessment body
- Testing against a defined certification scheme
- Ongoing compliance monitoring
- Recertification on significant changes
Kubernetes Recipes
Practical guide for container orchestration and deployment — hands-on patterns you can use today.
View on Amazon →Infrastructure Implications for Telecom
Modern telecom infrastructure is cloud-native. 5G core runs on Kubernetes. Network functions are containerized microservices. This means CRA compliance for telecom intersects with:
- EN 304 635 (container runtimes) — the infrastructure running the network functions
- EN 304 636 (firewalls/IDS) — security controls protecting the network
- EN 304 626 (operating systems) — the host OS layer
A telecom operator needs CRA compliance across the entire stack — from OS to container runtime to network function. This requires a holistic infrastructure approach, not product-by-product compliance.