The EU's Cybersecurity Resilience Act (CRA) has Begun – How Can Manufacturers Confidently Addres ...

The EU's Cybersecurity Resilience Act (CRA) has Begun – How Can Manufacturers Confidently Address It?

Speakers: Mars Cheng, Executive Director, TXOne Networks Inc.

Conference: FIRSTCON

YouTube: https://www.youtube.com/watch?v=LlS9jyJWnyo

Overview

The European Union's Cyber Resilience Act (CRA) represents a pivotal shift in global cybersecurity regulation, moving beyond data privacy to mandate comprehensive security requirements for all products with digital elements sold within the EU market. In this FIRSTCON talk, Mars Cheng, Executive Director at TXOne Networks, provided a critical breakdown of the CRA's implications, particularly from a manufacturer's perspective. Cheng emphasized the Act's high degree of difficulty and its far-reaching impact, asserting that it will affect manufacturers worldwide whose products touch the EU market, irrespective of their origin.

Unlike previous regulations such as GDPR, which primarily focused on data protection, the CRA targets the inherent security of digital products throughout their entire lifecycle—from design and development to maintenance and end-of-life. Cheng delineated the two primary phases of compliance: reporting obligations (Article 14), which become effective in September 2026, and manufacturer obligations (Article 13), slated for December 2027. His presentation offered practical advice and strategic frameworks for companies to navigate these complex requirements, underscoring the necessity of early preparation and robust internal processes to avoid significant penalties and reputational damage.

The talk highlighted that the CRA is not merely a legal hurdle but a fundamental call for manufacturers to embed security deeply into their product development and operational DNA. Cheng's insights were particularly valuable for product security teams, CISO offices, and legal departments, offering a roadmap for identifying product categories, conducting gap analyses, and implementing the necessary organizational and technical changes to achieve and maintain compliance. The overarching message was clear: the CRA demands a proactive, comprehensive, and continuously evolving approach to product cybersecurity.

Background

▶ Watch: EU CRA: Broad scope, product-focused, difficult compliance (0:30)

The genesis of the EU's Cyber Resilience Act (CRA) stems from a growing recognition that while data protection regulations like GDPR have addressed privacy concerns, a significant gap remained in ensuring the inherent cybersecurity of the digital products themselves. As our lives become increasingly intertwined with connected devices, software, and critical infrastructure, the potential attack surface expands dramatically. Vulnerabilities in these products pose not only economic risks but also national security threats and risks to public safety. The CRA was thus conceived to address this systemic risk by holding manufacturers accountable for the security of their products throughout their entire lifecycle.

Prior to the CRA, cybersecurity for digital products was often a fragmented landscape, with varying national standards and voluntary industry best practices. This led to an uneven playing field and a proliferation of insecure products entering the market, making consumers and organizations vulnerable to cyberattacks. The EU, through the CRA, aims to harmonize these standards, create a level playing field, and significantly elevate the baseline security posture of digital products. Mars Cheng underscored that this is not just another European regulation; its impact is global, as any manufacturer wishing to sell products with digital elements into the EU market must comply.

The talk specifically focused on two critical articles of the CRA: Article 14, which outlines the reporting obligations for actively exploited vulnerabilities and severe incidents, and Article 13, which details the broader security obligations for manufacturers concerning product design, development, and maintenance. These articles form the backbone of the CRA, pushing manufacturers to adopt a proactive, security-by-design approach and establish robust incident response capabilities. The challenge lies in the sheer breadth of products covered, the strict timelines, and the evolving nature of the harmonized standards that underpin the regulation. This context makes Mars Cheng's discussion of practical implementation strategies particularly relevant for organizations grappling with the impending deadlines.

Key Findings

▶ Watch: When to report: Active exploits and severe incidents (6:00)

Mars Cheng's presentation distilled several critical findings regarding the EU Cyber Resilience Act, emphasizing its profound impact and the substantial effort required for compliance.

First, the global reach of the CRA was a central theme. Cheng reiterated that any product with digital elements intended for sale within the EU market, regardless of its country of origin, must conform to the CRA. This makes it a de facto global standard, compelling manufacturers worldwide to adapt.

Second, the talk clearly segmented the compliance journey into two major, distinct phases with specific deadlines:

• Reporting Obligations (Article 14): This section, effective September 2026, focuses on the mandatory and time-sensitive reporting of actively exploited vulnerabilities and severe incidents impacting product support. Cheng highlighted the extremely tight reporting windows—24 hours for early warning, 72 hours for detailed information, and 14 days (for vulnerabilities) or 1 month (for incidents) for a final report. This demands unparalleled agility and preparedness from manufacturers.
• Manufacturer Obligations (Article 13): Becoming effective in December 2027, this phase covers the entire product lifecycle, from secure design and development to ongoing maintenance and vulnerability handling. It necessitates a fundamental shift in how products are conceived and managed, demanding secure-by-default principles and comprehensive Product Security Lifecycle (PSLC) integration.

Third, Cheng elaborated on the necessity for manufacturers to categorize their products accurately into four tiers: default products, important class one, important class two, and critical products. Each category dictates different conformity assessment modules, with higher-risk products requiring third-party verification. This categorization is the foundational step for understanding the specific technical requirements applicable to each product.

Fourth, the speaker stressed the critical role of gap analysis. Given the diverse product categories and the still-evolving harmonized standards (some currently 30% complete, others 80%), manufacturers must meticulously identify discrepancies between their current security practices and the CRA's requirements. This analysis must encompass secure design, vulnerability handling, incident response, and extensive documentation.

Finally, a recurring and paramount finding was the absolute necessity of internal coordination and rigorous exercises. Cheng emphasized that CRA compliance is not solely a task for product security teams; it involves a broad spectrum of internal stakeholders, including R&D, QA, CISO, Legal, PR, and Customer Success. Regular tabletop exercises are crucial for uncovering operational issues, refining processes, and ensuring that teams can meet the stringent reporting timelines and complex procedural demands under pressure. Without these drills, manufacturers risk being unable to respond effectively when real incidents occur.

Technical Deep Dive

▶ Watch: Mitigating zero-days and informing customers (14:00)

The EU Cyber Resilience Act (CRA) mandates a profound transformation in how digital products are secured and managed. Mars Cheng's talk delved into the technical and procedural intricacies of fulfilling its core requirements, specifically focusing on Article 14: Reporting Obligations and Article 13: Manufacturer Obligations.

Article 14: Reporting Obligations

This article, effective September 2026, imposes strict requirements for reporting cybersecurity incidents and vulnerabilities. Cheng identified two primary triggers:

1. Actively exploited vulnerabilities: When a manufacturer becomes aware that a vulnerability in their product is being actively abused in the wild. This includes receiving intelligence from threat intelligence sources or being notified of active attacks.
2. Severe incidents impacting product support: Incidents that affect the manufacturer's ability to support its products, such as disruptions to software or firmware update mechanisms.

The reporting timeline is exceptionally stringent:

• Early Warning Notification: Within 24 hours of becoming aware of the situation, an initial report must be submitted to ENISA (the European Union Agency for Cybersecurity) via the upcoming CRA single reporting platform. This initial report requires basic information, including the affected product and version.
• Vulnerability/Incident Information Notification: Within 72 hours, more detailed information, such as general vulnerability specifics, corrective actions, and initial investigations, must be provided.
• Final Report: For vulnerabilities, a final report is due within 14 days. For severe incidents, this extends to one month. This report must include comprehensive details on the root cause, impact, and final mitigation or resolution.

To meet these tight deadlines, Cheng proposed a structured internal process:

1. Identify Internal Stakeholders: Compliance is a cross-functional effort involving P-CERT (Product Security Incident Response Team), R&D, QA, CISO, Customer Success, Legal, and PR teams. Each plays a distinct role, from technical analysis to customer communication and legal review.
2. Plan Internal Process: Define clear procedures, roles, and responsibilities for each stage of reporting. This involves establishing communication channels, data collection methods, and decision-making frameworks.
3. Take a Drill/Exercise: Conduct regular tabletop exercises with diverse scenarios (e.g., a known vulnerability, a zero-day, a compromise of internal production systems). Cheng noted that TXOne Networks conducted over three such drills, identifying more than 32 items needing tracking and revision. These exercises expose execution-phase problems and foster coordination.
4. Announce Internal Compliance: Once processes are stabilized and tested, formally announce the company's readiness to comply with reporting obligations.

A key challenge highlighted was the handling of zero-day vulnerabilities. While the CRA demands a final report within 14 days, it does not necessarily require a full patch within this timeframe. Instead, manufacturers must propose strong mitigations and communicate these effectively to both ENISA and customers. The importance of notifying customers in parallel with regulatory bodies was strongly emphasized to maintain reputation and trust.

Cheng also underscored the need for strong Cyber Threat Intelligence (CTI) platforms. Manufacturers must not only react to reported vulnerabilities but also proactively "hunt our product vulnerabilities in the wild" to trigger early warning notifications. This proactive stance is crucial for timely compliance.

Article 13: Manufacturer Obligations

This article, effective December 2027, focuses on embedding security throughout the product lifecycle. It is arguably the "most difficult part" due to its product-specific nature and the sheer volume of requirements.

1. Conformity Assessment:

• Product Categorization: The first step is to accurately classify each product into one of four categories: default products, important class one, important class two, or critical products. Examples include operating systems, antivirus software, routers, and firewalls often falling into "important" or "critical" categories.
• Assessment Modules: The chosen category dictates the conformity assessment path:
• Module A: Self-proof, typically for default or important class one products adhering to harmonized standards.
• Module B+C, Module H (quality system assessment, recommended for very large companies with many product lines), or EUCC: These require third-party verification by a Notified Body. Cheng mentioned that Notified Bodies are expected to go live in August 2026, and manufacturers should evaluate them carefully.
• The process involves identifying the category, planning a tailored security process, performing the conformity assessment, and finally issuing a declaration of common conformity.

1. Gap Evaluation: This is the most challenging technical aspect. Manufacturers must conduct a detailed gap analysis for each product against the specific harmonized standards relevant to its type (e.g., antivirus, OS, router standards are all different). This analysis covers almost all aspects of product security, including:

• Secure by Default: Products must be designed with security as a primary consideration, with secure configurations enabled out-of-the-box.
• Product Security Lifecycle (PSLC): Integrating security practices into every phase: design (threat modeling, risk assessment), development (secure coding), testing (security testing), and maintenance (vulnerability handling, updates).
• Vulnerability Handling Process: Establishing clear procedures for receiving, assessing, and remediating vulnerabilities. Cheng noted that companies already part of organizations like FIRST (Forum of Incident Response and Security Teams) might have a head start here but still need to align with CRA specifics.
• Incident Handling: Procedures and response plans for cybersecurity incidents affecting the product.
• Documentation: Comprehensive technical documentation and user manuals explaining security features, update mechanisms, and secure usage guidelines are a "very huge part" of the CRA.

Cheng cautioned that the detailed harmonized standards are still in progress, with some technical committee documents only 30% complete while others are 80%. This evolving landscape necessitates continuous monitoring of EU websites for updates. He also clarified that even free products must comply if they are sold or made available in the EU market.

Overall, the Technical Deep Dive revealed that CRA compliance is an ongoing, multi-faceted journey demanding significant investment in processes, people, and technology, with a strong emphasis on proactive security, transparent reporting, and continuous improvement.

Demo / Proof of Concept

▶ Watch: Manufacturer obligations: Product categorization and assessment (19:50)

This talk was primarily focused on outlining the regulatory requirements and strategic approaches for compliance with the EU Cyber Resilience Act. As such, it did not include a live technical demonstration or a proof of concept of a specific tool or exploit. Instead, Mars Cheng delivered a procedural and strategic overview, emphasizing the organizational and process-oriented changes manufacturers must implement.

Defensive Implications

▶ Watch: Key takeaways: Awareness, CTI, and compliance exercises (28:00)

The EU Cyber Resilience Act (CRA) presents a comprehensive framework that necessitates a significant re-evaluation and enhancement of defensive strategies for manufacturers of digital products. Mars Cheng's talk provided several key defensive implications that organizations must consider to not only achieve compliance but also genuinely improve their cybersecurity posture.

1. Proactive Planning is Non-Negotiable: The most crucial defensive implication is the urgent need to start early. With reporting obligations (Article 14) effective September 2026 and manufacturer obligations (Article 13) in December 2027, waiting until the last minute is a recipe for failure. The complexity of gap analyses, process re-engineering, and stakeholder coordination demands a multi-year effort.

1. Establish Robust Internal Processes and Procedures: Defenders must develop and formalize clear, detailed procedures for vulnerability handling, incident response, and regulatory reporting. This includes defining workflows for intelligence reception, triage, technical analysis, mitigation development, and communication. The strict 24-hour, 72-hour, and 14-day/1-month reporting deadlines for Article 14 necessitate highly efficient and well-practiced processes.

1. Break Down Organizational Silos: CRA compliance is a cross-functional endeavor. Defensive teams (e.g., P-CERT, InfoSec) must actively collaborate with R&D, QA, Customer Success, Legal, and PR departments. This means establishing clear communication channels and shared understanding of roles and responsibilities during a security incident or vulnerability disclosure. The talk highlighted how Customer Success Managers are critical for identifying product deployment regions and customer impact.

1. Regular and Diverse Tabletop Exercises: To validate and refine these processes, organizations must conduct frequent and varied tabletop exercises. These drills should simulate different scenarios, such as a "normal" vulnerability, a zero-day exploit, or even a compromise of internal production lines or engineer devices. Mars Cheng noted that TXOne Networks identified over 32 trackable issues through their exercises, underscoring their value in uncovering operational gaps and preparing teams for high-pressure situations.

1. Comprehensive Product Categorization and Gap Analysis: Defenders need to meticulously categorize every product with digital elements according to the CRA's four tiers (default, important class one, important class two, critical). Following this, a thorough gap analysis must be performed against the relevant harmonized standards. This analysis will identify specific technical and procedural deficiencies in areas like secure by default configurations, Product Security Lifecycle (PSLC) integration, and documentation practices.

1. Invest in Cyber Threat Intelligence (CTI): The CRA's reporting triggers emphasize awareness of "actively exploited vulnerabilities." This mandates a strong CTI capability that goes beyond generic threat hunting to specifically "hunt our product vulnerabilities in the wild." Proactive intelligence gathering allows manufacturers to get ahead of potential incidents and initiate reporting early.

1. Prioritize Secure-by-Design and PSLC: The manufacturer obligations under Article 13 reinforce the need for secure-by-design principles and a fully integrated Product Security Lifecycle (PSLC). This means shifting security left, embedding it from the earliest design phases through development, testing, and continuous maintenance. This includes robust risk assessment, threat modeling, security testing, and ongoing vulnerability management.

1. Meticulous Documentation and Evidence Collection: A significant defensive task will be the creation and maintenance of extensive documentation. This includes technical documentation, user manuals with security instructions, and detailed records of security assessments, vulnerability handling, and incident responses. This "paperwork" serves as crucial evidence for conformity assessments, especially when dealing with Notified Bodies for higher-risk products.

1. Integrated Customer Communication: Defensive strategies must extend beyond regulatory compliance to include transparent and timely communication with customers. While ENISA must be notified, customers also need to be informed about product vulnerabilities, mitigations, and updates to maintain trust and enable them to take necessary actions.

By embracing these defensive implications, manufacturers can transform the CRA from a burdensome compliance exercise into a strategic opportunity to significantly enhance their overall cybersecurity resilience and product trustworthiness.

Key Takeaways

• Global Impact, Mandatory Compliance: The EU Cyber Resilience Act (CRA) is a mandatory, product-centric regulation affecting all digital products sold in the EU market, irrespective of origin, making it a de facto global standard.
• Dual Focus: Reporting & Lifecycle: Compliance is divided into two main areas: time-sensitive reporting of actively exploited vulnerabilities and severe incidents (Article 14, effective Sept 2026), and comprehensive manufacturer obligations covering the entire product security lifecycle (Article 13, effective Dec 2027).
• Process, Coordination, and Drills are Critical: Meeting CRA requirements demands robust internal processes, strong cross-functional stakeholder coordination (R&D, CISO, Legal, Customer Success), and regular tabletop exercises to prepare for rapid, high-pressure responses.
• Product-Specific Gap Analysis: Manufacturers must categorize products, conduct detailed gap analyses against evolving harmonized standards, and prepare extensive technical and user documentation for conformity assessment, which may require third-party verification by Notified Bodies.
• Proactive Security & Communication: Beyond reporting, the CRA mandates a proactive approach including strong Cyber Threat Intelligence (CTI) for vulnerability hunting, secure-by-design principles, and transparent communication with both regulatory bodies and customers.
• Start Early: The complexity, evolving standards (some currently 30-80% complete), and strict deadlines necessitate early and continuous engagement with CRA requirements to avoid significant penalties and ensure market access.

About the Speaker(s)

Mars Cheng is an Executive Director at TXOne Networks Inc., based in Taiwan, a company focused on securing industrial control systems and operational technology (OT) environments. He is also the Executive Director of the Association of Hacking Taiwan, an organization dedicated to fostering cybersecurity talent and awareness through conferences, competitions, trainings, and CISO summits. With extensive experience in the cybersecurity domain, Mars Cheng is a well-known figure on the global conference circuit, having spoken at prestigious events such as Black Hat USA, Black Hat Europe, Black Hat Asia, Black Hat Middle East & Africa, and the IC conference known as Blue conference multiple times. He is also a renewable member of the HITCON conference and training committee. Furthermore, his expertise extends to practical application, as he has served as a security auditor for various Taiwan government agencies and critical infrastructure organizations.