CRA Glossary: Key Terms & Definitions

Definition: Any software or hardware product and its remote data processing solutions, including software or hardware components to be placed on the market separately. This is the core scope of the CRA.

Example: Mobile apps, IoT devices, desktop software, embedded firmware, network equipment.

Definition: A manufacturer, authorised representative, importer, or distributor of products with digital elements. Each has specific obligations under the CRA.

Example: A software company (manufacturer), a EU reseller (importer/distributor).

Definition: Any natural or legal person who develops or has developed a product with digital elements and markets it under their own name or trademark, whether for payment or free of charge.

Example: A company that creates and sells software applications.

Definition: Any natural or legal person established in the EU who places a product with digital elements from a third country on the EU market.

Example: A EU company that imports and sells US-developed software.

Definition: Any natural or legal person in the supply chain, other than the manufacturer or importer, who makes a product with digital elements available on the market.

Example: A software reseller or online marketplace.

Definition: A formal, machine-readable record containing details and supply chain relationships of various components used in building software. Required by CRA for all products with digital elements.

Example: A CycloneDX or SPDX file listing all dependencies and their versions.

Definition: The process demonstrating whether a product meets the essential cybersecurity requirements of the CRA. Can be self-assessment (Module A) or third-party audit depending on product classification.

Example: Internal testing and documentation (Standard products) or Notified Body audit (Class II).

Definition: An independent organization designated by EU Member States to perform conformity assessments for Important Class II and Critical products, and for Important Class I products where the manufacturer does not fully apply harmonised standards (Article 32(2)).

Example: TÜV, BSI Product Certification, Bureau Veritas.

Definition: A marking that indicates a product conforms to EU legislation, including the CRA. Required before placing a product with digital elements on the EU market.

Example: The "CE" symbol on product packaging or documentation.

Definition: A weakness, susceptibility, or flaw of a product with digital elements that can be exploited by a cyber threat.

Example: An unpatched buffer overflow, SQL injection flaw, or misconfigured authentication.

Definition: A vulnerability for which there is reliable evidence that malicious actors have exploited it in a system without permission of the system owner.

Example: A zero-day vulnerability being used in ransomware attacks.

Definition: An update to a product with digital elements that addresses identified vulnerabilities or improves the security of the product.

Example: A patch release that fixes CVE-2024-XXXX.

Definition: The period during which the manufacturer ensures that vulnerabilities are handled effectively. Minimum 5 years from placing the product on market, or the expected product lifetime if shorter than 5 years.

Example: A commitment to provide security updates for at least 5 years after product launch (or product lifetime if less than 5 years).

Definition: National authorities responsible for receiving and handling vulnerability and incident reports. Manufacturers must report actively exploited vulnerabilities to CSIRTs.

Example: CERT-EU, BSI (Germany), ANSSI (France).

Definition: The EU agency that will operate the single reporting platform for vulnerability and incident notifications under the CRA.

Example: The central EU body coordinating CRA vulnerability reporting.

Definition: The mandatory security and vulnerability handling requirements defined in Annex I that all products with digital elements must meet.

Example: Secure default configuration, access control, data protection, update capability.

Definition: Products with higher cybersecurity risk requiring additional conformity assessment. Can self-certify if following harmonised standards.

Example: Identity management software, VPNs, password managers, browsers.

Definition: Products with significant cybersecurity risk requiring mandatory third-party conformity assessment (Notified Body).

Example: Firewalls, intrusion detection systems, hypervisors, container runtimes.

Definition: Products with the highest cybersecurity risk, requiring European cybersecurity certification when a scheme is mandated.

Example: Hardware security modules (HSMs), smartcard systems.

Definition: A process for receiving, handling, and publicly disclosing vulnerabilities in a structured manner that allows time for remediation before public disclosure.

Example: Following ISO/IEC 30111 standard for handling reported vulnerabilities.

Definition: The documentation required by CRA that demonstrates how a product meets the essential cybersecurity requirements. Must be maintained for 10 years.

Example: Risk assessment, design documentation, test reports, SBOM, conformity declaration.

Definition: A formal document stating that a product meets all CRA requirements. Signed by the manufacturer and required for CE marking.

Example: A PDF document accompanying the product stating CRA compliance.

Definition: Data processing at a distance for which the software is designed and developed by the manufacturer, or under their responsibility, and the absence of which would prevent the product from performing one of its functions.

Example: A cloud backend that a smart device depends on to function.

Definition: As defined in Article 2(1) of Regulation (EU) 2019/881 (ENISA Act): the activities necessary to protect network and information systems, users of such systems, and other affected persons from cyber threats.

Example: Encryption, access control, vulnerability management, and incident response.

Definition: The part of an electronic information system which consists of computer code.

Example: An operating system, application, firmware, or library.

Definition: A physical electronic information system, or parts thereof, capable of processing, storing or transmitting digital data.

Example: A router, IoT sensor, industrial controller, or network card.

Definition: Software or hardware intended for integration into an electronic information system.

Example: A cryptographic library, a network module, or a sensor chip.

Definition: A system, including electrical or electronic equipment, capable of processing, storing or transmitting digital data.

Example: A laptop, server, PLC, or connected home appliance.

Definition: A virtual representation of a data connection implemented through a software interface.

Example: An API connection, TCP socket, or Bluetooth protocol link.

Definition: A connection between electronic information systems or components implemented using physical means, including electrical, optical or mechanical interfaces, wires or radio waves.

Example: USB, Ethernet cable, Wi-Fi radio link, or optical fibre.

Definition: A connection to a device or network that does not take place directly, but as part of a larger system that is directly connectable to such device or network.

Example: A sensor that connects to the internet via a local gateway hub.

Definition: Any device that is connected to a network and serves as an entry point to that network.

Example: A laptop, workstation, smartphone, or IoT device on a corporate network.

Definition: A legal person, other than a manufacturer, that has the purpose or objective of systematically providing support on a sustained basis for the development of specific products with digital elements, qualifying as free and open-source software intended for commercial activities, and that ensures the viability of those products.

Example: Apache Software Foundation, Eclipse Foundation, Linux Foundation, CNCF.

Definition: A natural or legal person established within the EU who has received a written mandate from a manufacturer to act on their behalf in relation to specified tasks under the CRA.

Example: A EU-based import/compliance agent acting for a non-EU software company.

Definition: A natural person who acts for purposes outside their trade, business, craft or profession.

Example: An individual buying a smart home device for personal use.

Definition: Microenterprises, small enterprises, and medium-sized enterprises as defined in Commission Recommendation 2003/361/EC. They benefit from lighter CRA obligations in some areas.

Example: A startup with fewer than 50 employees and €10M annual turnover.

Definition: The first making available of a product with digital elements on the Union market.

Example: Releasing v1.0 of software to EU customers for the first time.

Definition: Supply of a product with digital elements for distribution or use on the Union market in the course of a commercial activity, whether for payment or free of charge.

Example: Distributing open-source software used in commercial products to EU users.

Definition: The use for which a product with digital elements is intended by the manufacturer, as specified in instructions for use, promotional materials, and technical documentation.

Example: A router marketed as a home broadband gateway — its intended purpose excludes enterprise-grade security management.

Definition: Use that is not necessarily the intended purpose but is likely to result from reasonably foreseeable human behaviour or technical operations.

Example: Using a developer-focused CLI tool as part of a production CI/CD pipeline.

Definition: The use of a product in a way not in accordance with its intended purpose, but which may result from reasonably foreseeable human behaviour or interaction with other systems.

Example: Connecting a consumer device directly to an industrial network without appropriate safeguards.

Definition: The national authority responsible for setting up and carrying out procedures for the assessment, designation and notification of conformity assessment bodies and for their monitoring.

Example: BSI (Germany), ANSSI (France), or NCSC (Netherlands) in their notifying capacity.

Definition: A change to a product with digital elements following its placing on the market that affects its compliance with essential cybersecurity requirements or modifies the intended purpose for which it was assessed.

Example: Adding a new network-facing interface to a previously offline-only device.

Definition: Union legislation listed in Annex I to Regulation (EU) 2019/1020 and other Union legislation harmonising the conditions for the marketing of products.

Example: Radio Equipment Directive (RED), Machinery Regulation, NIS2 Directive.

Definition: A market surveillance authority as defined in Article 3(4) of Regulation (EU) 2019/1020, responsible for monitoring and enforcing CRA compliance.

Example: BSI in Germany, ANSSI in France, NCSC in the Netherlands.

Definition: A European standard adopted on the basis of a request from the European Commission to support EU legislation, conferring a presumption of conformity with essential requirements.

Example: EN standards adopted under CRA that, when followed, grant presumption of conformity.

Definition: The potential for loss or disruption caused by an incident, expressed as a combination of the magnitude of such loss or disruption and the likelihood of occurrence.

Example: The risk of a remote code execution vulnerability being exploited in a widely deployed product.

Definition: A cybersecurity risk which, based on its technical characteristics, can be assumed to have a high likelihood of an incident causing severe negative impact, including considerable material or non-material loss.

Example: A known-exploitable vulnerability in critical infrastructure software with no available patch.

Definition: A vulnerability that has the potential to be effectively used by an adversary under practical operational conditions.

Example: A publicly disclosed CVE with a working proof-of-concept exploit.

Definition: An incident as defined in Article 6(6) of Directive (EU) 2022/2555 (NIS2): an event that compromises the availability, authenticity, integrity or confidentiality of stored, transmitted or processed data or related services.

Example: A successful ransomware attack that encrypts product data or disrupts a service.

Definition: An incident that negatively affects or is capable of negatively affecting the ability of a product with digital elements to protect the availability, authenticity, integrity or confidentiality of data or functions.

Example: A breach that exposes a product's private keys or disables its update mechanism.

Definition: A near miss as defined in Article 6(5) of Directive (EU) 2022/2555 (NIS2): an event that could have compromised the availability, authenticity, integrity or confidentiality of data or services, but was successfully prevented.

Example: A detected intrusion attempt that was blocked before data exfiltration occurred.

Definition: A cyber threat as defined in Article 2(8) of Regulation (EU) 2019/881: any potential circumstance, event or action that could damage, disrupt or otherwise adversely impact network and information systems.

Example: Malware campaigns, phishing attacks, zero-day exploit attempts, DDoS attacks.

Definition: Software the source code of which is openly shared and made available under a free and open-source licence that provides for all rights to make it freely accessible, usable, modifiable and redistributable.

Example: Linux kernel, OpenSSL, Apache HTTP Server, Node.js.

Definition: Any measure aimed at achieving the return of a product with digital elements that has already been made available to the end user.

Example: A manufacturer requiring customers to return devices due to an unfixable critical vulnerability.

Definition: Any measure aimed at preventing a product with digital elements in the supply chain from being made available on the market.

Example: Pulling a product from distribution channels before it reaches end users.

Definition: A CSIRT designated as coordinator pursuant to Article 12(1) of Directive (EU) 2022/2555 (NIS2), responsible for coordinating the handling of vulnerability notifications under the CRA.

Example: The national CSIRT in each EU Member State tasked with receiving CRA vulnerability reports.

Definition: A group established under Article 52(15) of the CRA for the uniform application of the Regulation, composed of representatives of designated market surveillance authorities. Also addresses market surveillance for open-source software stewards.

Example: ADCO coordinates enforcement consistency between BSI, ANSSI, NCSC and other national MSAs.