Essential Cybersecurity Requirements

The essential cybersecurity requirements are the binding technical and process requirements that every product with digital elements must satisfy under the CRA. They are set out in Annex I and divide into two groups: Part I covers product security properties (what the product must do); Part II covers manufacturer vulnerability handling processes (what the manufacturer must do). These requirements are 'essential' in the EU regulatory sense - they are mandatory minimum standards whose fulfilment is a precondition for CE marking and EU market access. They are not guidelines or best practices; non-compliance prevents lawful sale of the product in the EU.

The essential product security requirements in Annex I Part I require that products:

• Are free of known exploitable vulnerabilities at market placement.
• Are delivered with a secure default configuration.
• Have a minimal attack surface - only necessary interfaces and services are enabled.
• Protect the confidentiality and integrity of data using state-of-the-art cryptography.
• Implement access control mechanisms appropriate to the risk.
• Provide resilience against denial-of-service attacks.
• Limit data collection to what is strictly necessary for product function.
• Provide logging and monitoring capabilities proportionate to the risk.
• Include an authenticated, integrity-verified update mechanism.

The essential vulnerability handling requirements in Annex I Part II require manufacturers to:

• Identify and document all components in the product (SBOM).
• Monitor for vulnerabilities throughout the product support period.
• Apply and disclose vulnerabilities without undue delay, including providing free security patches.
• Publish a coordinated vulnerability disclosure (CVD) policy.
• Share vulnerability information with ENISA and CSIRTs as required by Article 14.
• Provide security advisories to affected users when patches are released.
• Inform users when the support period ends and stop collecting unnecessary data at end-of-life.

These obligations persist throughout the product's support period, not just at market placement.

Manufacturers demonstrate compliance through:

1. Harmonised standards - applying a European harmonised standard (once designated) creates a presumption of conformity with the requirements that standard covers.
2. Common Specifications - implementing European Commission-adopted technical specifications provides presumption of conformity.
3. Self-assessment (Default and Class I) - manufacturers document their technical evidence and sign an EU Declaration of Conformity.
4. Third-party assessment (Class II and Critical) - a notified body assesses technical documentation and may perform product testing.

Key evidence artefacts: product security test results, SBOM, CVD policy, advisory archive, penetration test reports, and threat model documentation.