Cyber Resilience Act (CRA)

Efficient implementation of the CRA requirements with Versio.io

In a nutshell Request demo Start free trial

What is the Cyber Resilience Act?

The Cyber Resilience Act (Regulation (EU) 2024/2847) is the first EU-wide law that sets mandatory cybersecurity requirements for products with digital elements. It covers practically all hardware and software products that are placed on the EU market and can be connected directly or indirectly to a device or network – from IoT devices and industrial controllers to firewalls, operating systems and business software.

While NIS2 and DORA regulate the operators of IT, the CRA addresses the manufacturers, importers and distributors of products. Manufacturers must ensure that their products are secure by design, that vulnerabilities are handled throughout the entire support period and that actively exploited vulnerabilities and severe incidents are reported. Compliance is confirmed by the CE marking; violations of the essential requirements can be fined up to EUR 15 million or 2.5% of total worldwide annual turnover.

Which parts of the CRA are relevant?

The legally binding basis is the regulation itself. For the technical and organisational implementation, the following parts are decisive:

Annex I, Part I - Cybersecurity requirements relating to the properties of the product, e.g. no known exploitable vulnerabilities, secure by default configuration, integrity protection and limited attack surfaces.
Annex I, Part II - Vulnerability handling requirements, e.g. software bill of materials (SBOM), remediation without delay, regular tests, coordinated vulnerability disclosure and secure distribution of updates.
Article 13 - Obligations of manufacturers, including the cybersecurity risk assessment, due diligence for third-party and open-source components and a support period of generally at least five years.
Article 14 - Reporting obligations for actively exploited vulnerabilities and severe incidents: early warning within 24 hours, notification within 72 hours and a final report.
Annex VII - Content of the technical documentation, including the risk assessment, the vulnerability handling processes, the SBOM and the information used to determine the support period.

Harmonised European standards that specify these requirements in more detail are currently being developed. Until they are published, the regulation text remains the reference for the mapping below.

CRA timeline: what applies when?

10 December 2024 - The CRA entered into force.
11 June 2026 - The provisions on the notification of conformity assessment bodies (Chapter IV) apply.
11 September 2026 - The reporting obligations under Article 14 apply - for all products with digital elements on the market, including those placed on the market before this date.
11 December 2027 - All other obligations apply in full. From this date, new products may only be placed on the EU market if they meet the CRA requirements.

Your CRA tool: Versio.io

The CRA requires manufacturers to know at all times which components are contained in which product version, which vulnerabilities affect them and how long they are supported. Versio.io automates exactly this inventory and monitoring work and provides audit-proof evidence for the technical documentation and for market surveillance authorities.

The following sections show which CRA requirements Versio.io supports. Requirements relating to the secure design of the product itself, such as encryption or authentication mechanisms, remain the responsibility of your product development.

Software bill of materials (SBOM) and component inventory

CRA: Annex I Part II (1); Art. 13(5); Annex VII (2)(b), (8)

Versio.io automatically detects hardware, operating systems, software products and frameworks with their exact versions. From this inventory, you can create an SBOM for each product version or import SBOMs supplied by your suppliers. This gives you a complete, machine-readable overview of all components and third-party dependencies – the basis for due diligence and vulnerability handling.

Versio.io software asset management and SBOM

Versio.io CMDB

Vulnerability management

CRA: Annex I Part I (2)(a); Annex I Part II (2), (3); Art. 13(6)

Versio.io continuously compares all detected component versions with an up-to-date CVE database. New vulnerabilities are reported immediately, including the affected products and versions, and Versio.io recommends which versions you should switch to. This helps you to place products on the market without known exploitable vulnerabilities and to remediate vulnerabilities without delay during the support period.

Versio.io product lifecycle and vulnerability management

Support period and end-of-life management

CRA: Art. 13(8), (19); Annex II (7); Annex VII (4)

Your product must be supplied with security updates for at least five years. This is only possible if the components it contains are themselves maintained. Versio.io knows the end-of-life dates of thousands of products and warns you early if a component loses manufacturer support before the end of your own support period. This information also serves as documented evidence when determining the support period.

Versio.io end-of-life management

Cybersecurity risk assessment

CRA: Art. 13(2)-(4), (7); Annex VII (3)

The CRA requires a documented risk assessment that is kept up to date throughout the support period. Versio.io brings together outdated versions, known vulnerabilities and configuration violations as risks, weights them according to severity and protection requirements, and tracks all corrective measures in an audit-proof manner.

Versio.io risk management

Secure by default configuration and hardening

CRA: Annex I Part I (2)(b), (j)

Versio.io checks configurations against your own policies and recognised hardening benchmarks. Use it to verify reference systems, images and appliances before delivery: unnecessary services, open ports and insecure default settings are detected before the product reaches the customer.

Versio.io benchmark governance

Versio.io policy monitoring

Integrity of software and configurations

CRA: Annex I Part I (2)(f); Annex I Part II (7)

Versio.io monitors the integrity of binary files and configurations using checksums. Unauthorised modifications to programs, libraries or configuration files – whether in your build and release environment or in delivered installations – are detected immediately.

Versio.io integrity verification of binary files

Change monitoring and technical documentation

CRA: Art. 13(3), (13), (14); Annex VII (1)(b), (2)(c)

Every change to versions, components and configurations is automatically detected and historised in an audit-proof manner. This allows you to prove at any time which version of your product contained which components and which vulnerabilities were known at that time – even years later, as the technical documentation must be kept for at least ten years.

Versio.io change monitoring

Reporting obligations and incident handling

CRA: Art. 14(1)-(4), (8); Annex I Part II (4)

The 24-hour deadline for an early warning starts as soon as you become aware of an actively exploited vulnerability. Versio.io alerts you immediately, creates tickets in your ITSM solution and shows which products, versions and customer installations are affected. The complete history from detection to the security update is documented in an audit-proof manner and provides the information you need for the notification and the final report to the CSIRT and ENISA.

Versio.io event processing and alerting

Also relevant for operators

The CRA also benefits companies that use products with digital elements: manufacturers must provide information on the support period and, where applicable, the SBOM. Versio.io imports this information, compares it with your installed base and monitors vulnerabilities and end-of-life dates – an important building block for supply chain security as required by NIS2 and DORA.