ETSI advances cybersecurity standards for EU Cyber Resilience Act

The European Telecommunications Standards Institute (ETSI) has moved 17 cybersecurity standards into the formal approval process to support the implementation of Europe’s Cyber Resilience Act (CRA). These standards aim to translate the legal obligations of the CRA into specific technical requirements for manufacturers.

The standards cover various categories, including network and edge devices, security solutions, and Internet-of-Things (IoT) appliances such as routers, operating systems, browsers, password managers, smart home devices, and security software. To comply with the CRA and sell covered products in the EU starting in December 2027, manufacturers must meet baseline security requirements. These include modern encryption, secure default configurations, mechanisms for delivering security updates, and the use of a machine-readable software bill of materials (SBOM) to document software dependencies.

Industry experts note that these drafts allow manufacturers to evaluate existing products against upcoming requirements. Additionally, the CRA’s vulnerability reporting obligations, which require manufacturers to submit an early warning for actively exploited vulnerabilities within 24 hours, are set to begin on September 11.