Topic starter
25/06/2026 10:48 pm
TL;DR: The Cyber Resilience Act makes cybersecurity mandatory across the full product lifecycle for connected devices sold in the EU, with vulnerability reporting starting in 2026 and full enforcement in 2027, according to Keyfactor. For manufacturers, this turns device identity, cryptographic trust, and update governance into board-level compliance work, not post-release hardening.
Editorial analysis by NHI Mgmt Group, based on content published by Keyfactor: “Not Business as Usual: What IoT Manufacturers Need to Know About the Cyber Resilience Act”.
By the numbers:
- The Cyber Resilience Act became effective on December 11, 2024, according to Keyfactor.
- Vulnerability reporting starts on September 11, 2026, according to Keyfactor.
- Full enforcement begins on December 11, 2027, according to Keyfactor.
Key questions
Q: What breaks when IoT security is treated as a post-release fix under the Cyber Resilience Act?
A: Post-release security breaks because the CRA expects secure design, disclosure discipline, and cryptographic integrity to exist across the full lifecycle.
Q: Why do cryptographic trust controls matter so much for CRA compliance?
A: They are the proof that a device is genuine, its firmware is authentic, and its updates can be trusted over time.
Q: How should IoT manufacturers sequence CRA readiness work?
A: Start with product scoping, then classify the estate, then assess gaps in cryptography, update handling, and identity provisioning.
Practitioner guidance
- Map product SKUs against CRA scope Classify each connected product as General, Important, or Critical so the organisation knows which lifecycle controls and evidence requirements apply.
- Govern device identity from provisioning onward Bind each device to a trustworthy identity at manufacture and maintain ownership, renewal, and revocation through the full product lifecycle.
- Harden firmware trust chains Use secure boot, certificate-based firmware signing, and supply chain-integrated identity so update authenticity remains verifiable after shipment.
Bottom line: The Cyber Resilience Act shifts IoT security from a launch concern to a lifecycle assurance requirement.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 11:29 pm
CRA readiness is now a lifecycle identity problem, not a release checklist. The regulation makes device trust, firmware authenticity, and update governance part of the product’s continuing assurance story. That means the control boundary starts at provisioning and ends only at decommissioning. Manufacturers that still treat security as post-release hardening are applying the wrong operating model.
A question worth separating out:
Q: What should security teams do when a connected product must stay in use for years?
A: They should design for sustained verifiability, not just launch-day trust. That means preserving firmware signing, certificate renewal, revocation handling, and decommissioning controls for as long as the device remains deployed, because long-lived products outlast many original assumptions.
👉 Read our full editorial: Cyber resilience act readiness is now a lifecycle identity problem