Assurance goals
CRA preparation
How product security testing can help manufacturers investigate weaknesses ahead of the EU Cyber Resilience Act obligations.
Regulation (EU) 2024/2847, the Cyber Resilience Act, sets cybersecurity requirements for products with digital elements and obligations for manufacturers. Reporting obligations for actively exploited vulnerabilities and severe incidents apply from 11 September 2026. Most other obligations apply from 11 December 2027.
How testing can support this goal
- Investigation of product security weaknesses across firmware, software, interfaces and update mechanisms, within the agreed scope.
- Evidence that supports vulnerability handling, including triage and prioritisation of findings.
- Technical input for the risk assessment and technical documentation.
- A way to check whether security-by-design decisions hold up in the tested product.
What testing does not do
- Testing does not provide CE marking, conformity assessment or certification.
- Conformity assessment and any notified-body requirements depend on the product category. Check the Regulation and its annexes.
- A test before release cannot cover vulnerabilities that are discovered later.