In an environment of narrow and voluntary product security frameworks and regulations, the EU Cyber Resilience Act presents a step change for businesses deploying connected products into the European Union.
Compliance becomes a gatekeeper for access to the market, and the only exclusions are for product categories that are already heavily regulated.
This presents unique challenges for many businesses which, until now, have faced no mandatory minimum product security standards. The shift in obligations means businesses will be grappling with complex security topics in areas where they lack prior experience and in-house expertise.
While large organisations make up the substantial majority of revenue for impacted products, this doesn’t tell the full story. Because of the wide net EU CRA casts, and the minimal carve outs, it is estimated that 99% of all impacted businesses are small and medium sized.
The organisations that succeed will be those that adopt a structured approach to the regulation through genuine improvement of their product security and resilience. Technical excellence alone will not be enough. Operational preparedness is a central pillar of the requirements, and client procurement pressures will necessitate meaningful evidence gathering activity.
How businesses approach alignment to the Cyber Resilience Act will determine not only initial success in adhering to it, but how effectively they can meet its demands into the future.
The regulations capture a broad horizontal segment of products, but this doesn’t necessarily mean that an entire business’s product catalogue will fall under the regulations.
Product inventory already placed on the market before 11 December 2027 and some special categories of products (e.g., aviation, medical) are exempt.
It’s also important to understand that the scope of EU CRA may in some cases be broader and capture more than an organisation anticipates. For example, if an organisation imports or distributes someone else’s white-labelled products under its own name, then it inherits the full set of obligations for those products.
The pre-11 December 2027 carve out only applies to individual units, not a product type. And any substantial modification to those units after the date brings them into scope.
An EU Cyber Resilience Act compliance project requires clear planning and resourcing. The regulations require review of, and potential changes to, many areas of a business, from product design to software development, legal counsel, and customer service.
Gaining leadership buy-in from decision makers is vital for effective execution of organisation readiness. Without this support, coordinating a compliance programme becomes inefficient and fragmented. Necessary resource goes unallocated, timescales are stretched and compliance is put at risk.
Understanding and assigning internal responsibilities for teams and individuals when planning a compliance programme is key to operational success. It must be clear who within a business owns the strategic implementation, and who is accountable for each tranche of compliance.
Consider how centralised compliance execution should be. The 24-hour notification window for vulnerability exploitation and severe incidents mandated by EU CRA necessitates rapid internal communication and coordination. Even with sufficient planning, the reporting timescales require clarity from everyone on the role that they play. A RACI matrix can be a useful framework for achieving such clarity.
Much of the regulation formalises best practices in secure product design, development, and operations. As a result, businesses that have well established development and security programmes will already be implementing many of the requirements.
An organisation must understand its current compliance position before embarking on any roll out of new practices or documentation. By assessing each area of the requirements against existing business practice, more efficient and coordinated implementation plans can be presented to leadership sponsors.
If European Standards organisations haven’t published formal implementation guidance when a business comes to plan EU CRA compliance, advice from the European Commission is clear: do not wait.
There is no single correct path to compliance, and essential requirements are listed clearly in the regulation’s annexes. Businesses that have completed an assessment of their current product security posture should begin planning their remediation programme, and look to analogous established security frameworks to guide their implementations.
The regulation should not be framed merely as a box ticking exercise. The requirements are rigorous, but also lean enough to allow compliance activities to become transformative for a business’s product security.
Organisations will come out of the process with capabilities that genuinely strengthen operational confidence in incident response, while solidifying product competitiveness during the sales process, and improving client relationships in the face of ever more thorough cyber scrutiny.
Ask the right questions from the start to set up for success.
Build your compliance programme so that evidence of your product security comes from what the business already does.
Bedrock Cyber supports organisations in planning for and delivering EU CRA compliance with processes that generate proof without additional burden.
Looking to go deeper? Find examples of compliance readiness activities and a pathway outline in Bedrock Cyber’s EU CRA Factsheet.
]]>If you place products with digital elements onto the EU market, including mobile apps, you are likely to be affected and might need to take action to be compliant.
Download Bedrock Cyber’s EU CRA Factsheet to quickly learn what you should know today.
Complying with the act is not a one-size-fits-all exercise. The standard doesn’t change with company size, but the practical implementation does.
It is common for teams to already be doing more security work than they realise or can currently point to evidence for.
]]>Suppliers into the critical infrastructure space have a host of requirements to deal with that simply don’t exist in other sectors. This burden becomes even more acute once you’re delivering solutions that are involved in real world interventions. AI and ML features and behaviour can then act as a multiplier on top.
It’s one thing to have to defend the security of your product when it’s handling personal data or storing sensitive geospatial infrastructure data. But much of the CNI supplier landscape interacts with the physical world in ways that other sector businesses simply don’t have to contemplate.
You don’t see Salesforce worrying about whether a bad update is going to mean a burst pipe on the high street goes unreported. If Jira metrics are reporting the wrong numbers for a couple of hours, it doesn’t result in a burst water main. And the latest hotshot e-commerce start-up doesn’t need to worry about being in hot water with the Environment Agency: if their AI modelling goes wrong, it’s not going to result in erroneous EDM reporting.
ISO 27001 is the de facto standard for managing risk in information systems and for demonstrating that security is an audited priority amongst your people and technology. But it’s not a silver bullet and can be misinterpreted and misapplied, resulting in a certification that satisfies clients on a surface level, but which begins to break down for those that dig a little deeper.
Even worse, it can result in a false sense of security while your solution is left exposed to the realities of contemporary threats.
The problem with trying to fit conventional information security practices onto products in this space is that the security industry and its practitioners are often heavily weighted towards confidentiality. Protecting the secrecy of data in transit, in storage, ensuring access to it is recorded. In an information age, this makes sense. Data is treated like the crown jewels because it usually is.
But when delivering solutions that interact with the world around us, availability of data, and integrity and trust in that data, is often just as if not more important than confidentiality.
A sensor’s readings are unlikely to be sensitive on their own, but if they can be intercepted and suppressed, then you’ve got an overflow event on your hands that your product was supposed to proactively detect.
You might prevent all but your most senior engineers from accessing anomaly data, but if they can accidentally overwrite it, then you’ve got a failed regulatory obligation.
No data has been stolen, no one is making a report to the ICO, your systems haven’t been ransomwared, but when your business model is built around proactive detection and event containment, trust in the product is essential, and it’s just been eroded.
The security industry needs to do better by clients and not just apply frameworks like ISO 27001 by blindly following the same playbook every time. Different organisations have different security needs, and security must be evaluated in the context of the product and systems being protected. ISO 27001 is an adaptable and highly effective risk management framework when applied correctly.
Organisations shouldn’t be getting to ISO 27001 certification by systematically applying the 93 controls from Annex A of the standard. This does a disservice to the business underneath. The 93 controls were never intended to be a prescriptive list of requirements. They’re guidelines and recommendations of how to manage security risk and should be treated as such, and there are mechanisms build into the standard for justifying why a control isn’t relevant.
The National Cyber Security Centre (NCSC) themselves say in their Machine Learning Principles publication that there’s no one size fits all, and that ML systems require additional consideration above and beyond established cyber security best practice. Just from that, we can infer that if a service incorporates ML elements, then the standard 93 controls from ISO 27001 are likely to provide insufficient protection.
The NCSC publication talks about poisoning attacks where manipulated data finds its way into training, and reshapes the definition of normal. A model that’s subversively trained on tampered readings could end up reporting a healthy network where the reality is anything but.
The benefit of the framework is that it is designed to be flexible and adaptable to any shaped organisation. By asking some fundamental questions of teams, it doesn’t have to be difficult to evaluate how effectively it’s working:
The good news is that because ISO 27001 is non-prescriptive by design, it can support and help frame processes that fit the real security needs and risks inside an organisation.
And the even better news is that a correctly scoped certification means only needing to do the things that are actually relevant to your risk. You end up with something that’s both more tailored and therefore more secure, and also involves less overhead to maintain.
Doing product security right doesn’t need to be burdensome, but it does require the coming together of specialist expertise from within an organisation and the specialist security expert who can bring the correct controls for that organisation.
Once we get away from the generalist one size fits all thinking, real change and real defence of our vital infrastructure is achievable.
]]>Technology suppliers are used to being the innovative partner in the operator-supplier relationship. The image conjured is of utility operators in their dusty offices, celebrating the “newbie’s” 20-year work anniversary, akin to a Flash the sloth scene from Zootopia.
Meanwhile, the trailblazing Silicon Valley adjacent technology supplier occupies a swanky London office with something called a “breakout room”, lamenting their clients’ languid progress toward moving into the 21st century.
But UK regulatory pressures are changing the utility operator landscape, and suppliers who rest on their laurels are at risk of falling behind in areas that matter most to their clients.
The EU Cyber Resilience Act is a significant step change for suppliers. Security practices that for years had been considered option best practice, nice to haves that the team would get to “one day”, are now barriers to entering the EU market.
The implementation of the Cyber Security and Resilience Bill will push operators even further than existing NIS regulations and they’ll adapt accordingly. Suppliers need to be ready to meet the inevitable increased maturity of operators’ security questionnaires.
Operators are adopting modern platforms to help manage the changing regulatory landscape when it comes to third party risk management. While their newly implemented risk management platform might be the thin end of the wedge today, it becomes a problem for suppliers who aren’t prepared when the operator need only flip a switch to start demanding answers to more thorough criteria aligned to the Cyber Security and Resilience Bill.
The truth is, it’s not just the operators that feel the sharp end of new cyber regulation, because much of that pressure ends up pushed down the supply chain, and all else being equal, it will be the suppliers ready to meet that challenge with minimal disruption to their day to day operations who will flourish and succeed.
As a supplier to critical infrastructure, it doesn’t matter how innovative and revolutionary a solution might be; if their cyber risk profile doesn’t meet the operator’s requirements and they can’t get into the client’s supply chain, then they have a problem.
But there’s a more insidious danger waiting for the chosen ones who do make it through, and that is in the regular reviews of third-party risk that operators now conduct. Procurement is no longer the only moment when suppliers are expected to answer cyber security questions and so that heavy lift to get the deal over the line becomes a regular burden that commonly spans across multiple teams.
By operating in the classic model of point in time evidence gathering, suppliers put themselves at risk of the dual threat of operators requiring answers not only to more thorough security questions, but also of those same operators asking more often.
If suppliers don’t adapt, they will end up with more of their people spending more time on cyber reviews: time which could otherwise be spent on operational delivery.
Utility operators are responding as a result of top-down regulatory pressure. But their technology suppliers are uniquely positioned to innovate.
If suppliers update working practices and the way they approach security so that evidence is generated naturally as part of their daily operations, then there is real opportunity to get ahead and not just respond to customer demand but do what they have always done: trailblaze.
]]>