Breakdown of the 22 Cyber Resilience Act Requirements

The Two Pillars of CRA Annex I

Annex I is divided into two parts: Essential Cybersecurity Requirements (Product capabilities) and Vulnerability Handling Requirements (Manufacturer processes).

Part I: Product Capabilities

Where applicable (based on your risk assessment, Annex I Part I, point (2)), your product must have these traits:

• Risk-appropriate security: Designed to withstand expected threats.
• Secure by Default: Ships in the most secure configuration possible.
• Access Control: Strong authentication and principle of least privilege.
• Data Protection: Protect the confidentiality of stored, transmitted or processed data, e.g. by encryption at rest and in transit with state-of-the-art mechanisms.
• Integrity: Protection against unauthorized modifications.
• Data minimisation: Process only data that is adequate, relevant and limited to what is necessary for the intended purpose (Annex I Part I, point (2)(g)).

Part II: Vulnerability Handling

You must possess these operational capabilities:

• SBOM generation: Machine-readable dependency tracking.
• Patch delivery: Timely security updates offered free of charge.
• Coordinated vulnerability disclosure: A policy on coordinated vulnerability disclosure and a contact address for reporting vulnerabilities (Part II, points (5) and (6)).

Check which requirements apply to your specific product by using our Requirements Explorer.