Topic starter
06/11/2026 6:39 pm
TL;DR: The EU Cyber Resilience Act will place password managers in the important-products class, add CE-marking and self-assessment duties by December 2027, and require faster incident reporting from September 2026, according to Dashlane research, while EN 304 618 sets out controls for secret generation, encryption, authentication, session management, and audit logging. The policy shift matters because it turns password manager security into a regulated baseline, not a product preference.
Editorial analysis by NHI Mgmt Group, based on content published by Dashlane: “What the Cyber Resilience Act Means for Password Managers”.
By the numbers:
- Starting September 2026, manufacturers must notify ENISA and their national CSIRT within 24 hours of discovering an actively exploited vulnerability or a severe security incident.
- A fuller notification is due within 72 hours and a final report within 14 days.
- By December 2027, all password managers sold in the EU will have to self-assess conformity to the new standard.
Key questions
Q: How should teams evaluate password managers under new product-security rules?
A: Evaluate password managers against secret storage, sharing, and recovery controls, plus how they support account ownership, least privilege, MFA, and emergency access.
Q: What should security teams look for in password manager audit logging?
A: Look for logs that record who accessed which vault, which secret was viewed, copied, shared, edited, or rotated, and from where.
Q: How do product security regulations affect identity governance programmes?
A: Product security regulations push identity governance programmes to prove who has access, why they have it, and how it is reviewed.
Practitioner guidance
- Assess password managers against regulated control evidence Require suppliers to show how secret generation, encryption, authentication, session management, and audit logging are implemented and evidenced.
- Align procurement with CRA conformity milestones Track whether the product class, self-assessment path, and reporting obligations fit your buying cycle and assurance calendar.
- Review incident notification ownership now Define who decides whether a vulnerability or incident meets the 24-hour, 72-hour, and 14-day reporting thresholds.
Bottom line: The CRA reframes password managers as regulated security infrastructure, not just productivity software.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:42 pm
CRA regulation turns password managers into governed identity infrastructure: Once a password manager stores credentials, authenticators, and vault events, it is no longer just a productivity layer. The CRA effectively treats it as regulated security infrastructure whose controls must be demonstrable, not assumed. That matters because identity programmes often buy these tools for convenience and only later discover they are part of audit, procurement, and risk governance. Practitioners should treat this as a boundary shift in how the category is managed.
A question worth separating out:
Q: What is the best way to manage reporting deadlines after a severe security incident?
A: Manage reporting deadlines with a documented incident response process that assigns roles, preserves evidence, and tracks when the incident was detected, contained, and assessed. Build in legal and regulatory triage, escalation paths, and time-stamped decision logs so the team can meet notification windows even while containment and recovery are still under way.
👉 Read our full editorial: CRA compliance reshapes password manager security requirements