Inside The CRA Standardisation Trenches: Our Struggle To Harmonise

### Overview In this talk, security consultant Raoka Vizu (Bureau of Cyber Security) and industrial automation specialist Wendy Togs (Omron) share an inside look at drafting the European Union's Cyber Resilience Act (CRA) standards. Both speakers are active members of CEN-CENELEC Working Group 9, the group responsible for developing horizontal harmonized standards that apply across all products with digital elements. The presentation addresses what the CRA requires, the implications for manufacturers and software developers, and the significant hurdles faced when drafting horizontal standards under aggressive timelines.

### Key Topics - **Scope and Nature of the CRA**: The CRA targets nearly all products with digital elements, encompassing both hardware and software (including supporting tools and commercial software connecting to operating systems), requiring secure-by-design principles throughout product lifecycles. - **Product Classification & Conformity**: Products are divided into default/standard products (roughly 90% of the market) and special categories outlined in Annex 3 (important products, classes 1 and 2) and Annex 4 (critical products). Special classes dictate conformity assessment methods, ranging from self-assessment using harmonized standards to mandatory third-party assessments or European cybersecurity certification (such as Common Criteria). - **Regulatory Interplay**: Sectors with specific existing cyber requirements (automotive, medical, aviation, maritime) have exclusions, but products falling outside those specific boundaries (e.g., standard firewalls in hospitals) still fall into the CRA. The CRA also aligns with NIS 2 requirements for critical infrastructure suppliers and complements frameworks like the AI Act under the New Legislative Framework. - **Harmonized Standards Mandate**: Standards developed by CEN-CENELEC and ETSI under European Commission standardization requests provide a presumption of conformity required for the CE mark.

### Technical Details & Implementation Challenges - **Strict Timelines**: The CRA entered into force in December 2024. Reporting obligations for actively exploited vulnerabilities and severe cybersecurity incidents become mandatory on September 11, 2026 (requiring notification to national CSIRTs and ENISA's single reporting platform). The entire regulation and its technical requirements become mandatory on December 11, 2027. - **Process vs. Product Conformity**: Harmonized standards face structural contradictions. For example, essential requirements mandate secure development processes, yet CE marks apply strictly to the end product. Other legal demands, such as providing product security updates free of charge, cannot be written directly into a technical standard, complicating presumption of conformity. - **Reaching Consensus Under Time Pressure**: While mature standards typically take roughly five years to reach consensus, Working Group 9 delivered a first draft in May after a December standardization request and reached the inquiry stage within months. Reconciling varied stakeholder needs—from multinational corporations with established frameworks like IEC 62443 to small-and-medium enterprises (SMEs) and open-source contributors—proves exceptionally difficult.

### Takeaways Manufacturers cannot delay preparation while waiting for finalized harmonized standards. By December 11, 2027, products lacking a CE mark cannot be placed on the EU market. Although the CRA does not directly regulate non-commercial open-source projects, manufacturers integrating open-source or third-party components remain liable for ensuring long-term compliance. The speakers urge industry practitioners, software developers, and SMEs to participate directly in their national standardization bodies and comment during the standard's inquiry phase.