CRA Compliance for Serverless Functions
Specific engineering requirements and security-by-design principles to make Serverless Functions compliant with the Cyber Resilience Act.
Core Definition
Building Serverless Functions under the Cyber Resilience Act requires strict adherence to secure-by-default and secure-by-design principles. Serverless Functions are considered 'products with digital elements' or core components of them, meaning you are legally required to manage their vulnerabilities, patch them effectively for up to 5 years, and maintain complete component transparency via an SBOM.
Key Compliance Steps for Serverless Functions
- Generate accurate SBOMs: Use tools specific to Serverless Functions to generate CycloneDX or SPDX Software Bill of Materials in your CI/CD pipeline.
- Enforce 'Secure by Default': Ensure Serverless Functions ship with the most restrictive permissions, no default passwords, and encryption enabled by default.
- Implement Over-The-Air (OTA) Updates: Guarantee that patches can be successfully deployed to Serverless Functions seamlessly to fix critical vulnerabilities.
- Manage Third-Party Risk: Track open-source dependencies within your Serverless Functions to prevent supply chain compromise.
How This Plays Out in Practice
Track function-level dependencies separately per Lambda/Cloud Function, since serverless architectures often have dozens of independently-deployed functions each with their own dependency tree.
What to Watch For
Overly broad IAM execution roles attached to individual functions, granting far more access than any single function actually needs, are the recurring finding.
Assess Your CRA Readiness
Evaluate your product's Cyber Resilience Act readiness using our interactive tool. Find exactly which of the 22 security requirements apply directly to Serverless Functions.