EU Cyber Resilience Act

Mandatory cybersecurity requirements for products with digital elements sold in the EU.


Short name	EU CRA
Region	Europe
Country or scope	European Union
Sector	Government
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers EU CRA

Scan requirements: 7, all decided by a scan.
Controls: the scan requirements below, plus 15 controls from Safeguard's control catalog for EU CRA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 26: 4 written for EU CRA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 7 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`EU-CRA-II1` SBOM of Top-Level Dependencies	Manufacturers must identify and document vulnerabilities and components in the product, including by drawing up an SBOM in a commonly used machine-readable format (CRA Annex I Part II(1))	Scan
`EU-CRA-II1B` Documented Component Set	The vulnerability-handling SBOM must actually enumerate the product's components, at minimum its dependencies (CRA Annex I Part II(1))	Scan
`EU-CRA-II2` Vulnerability Remediation Without Delay	Vulnerabilities must be addressed and remediated without delay, including via security updates, which requires exact component versions to match advisories and target fixes (CRA Annex I Part II(2))	Scan
`EU-CRA-II8` Coordinated Disclosure Contact	Manufacturers must have a coordinated vulnerability disclosure policy and provide a contact address for reporting vulnerabilities, so composition documents must carry reachable creator contact details (CRA Annex I Part II and Annex II information requirements)	Scan
`EU-CRA-I-INT` Integrity Protection	Products must protect the integrity of stored, transmitted or processed data, commands and configuration, including corruption of the software itself, supported by component integrity hashes (CRA Annex I Part I essential requirements on integrity)	Scan
`EU-CRA-13SC` Due Diligence on Third-Party Components	Manufacturers must exercise due diligence when integrating third-party components so they do not compromise the product's security, requiring supplier attribution per component (CRA Art. 13, manufacturer obligations on third-party components)	Scan
`EU-CRA-TDOC` Technical Documentation Identity	Technical documentation, including the SBOM, must be drawn up before market placement and kept for at least ten years, requiring identifiable, timestamped documents (CRA Art. 31 and Annex VII)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`CRA-AX1-1`	Deliver Products Without Known Exploitable Vulnerabilities
`CRA-AX1-2`	Implement Secure-by-Default Configuration
`CRA-AX1-3`	Protect Against Unauthorised Access
`CRA-AX1-4`	Ensure Data Confidentiality and Integrity
`CRA-AX1-5`	Minimise Attack Surface
`CRA-AX1-6`	Mitigate Effects of Security Incidents
`CRA-AX2`	Provide SBOM for Third-Party Components
`CRA-ART10-1`	Exercise Due Diligence on Third-Party Components
`CRA-ART11`	Report Actively Exploited Vulnerabilities to ENISA
`CRA-ART14`	Implement Coordinated Vulnerability Disclosure
`CRA-ART18`	Perform EU Declaration of Conformity
`CRA-ART21`	Affix CE Marking and Maintain Technical Documentation
`CRA-ART27`	Ensure Importers and Distributors Comply with CRA
`CRA-UPDATE`	Provide Security Updates Throughout Support Period
`CRA-VULN-MGMT`	Maintain Vulnerability Management Process

Policy templates

Written for EU CRA:

EU CRA Product Security Policy
EU CRA Coordinated Vulnerability Disclosure Policy
EU CRA SBOM Management Policy
EU CRA Security Incident Reporting Policy

And 22 from the standard set, adapted to EU CRA.