Start » Learning Center » Blog » What is The Cyber Resilience Act?

What is The Cyber Resilience Act?

In recent years, many laws and regulations about cybersecurity have been set. And there are more coming, The Cyber Resilience Act amongst others. In this blog post, we will clarify what the Cyber Resilience Act is and what impact it will have.

What is the cyber resilience act?

The Cyber Resilience Act can be seen as a complement to the NIS Directive, and in the future, NIS2. The NIS Directive aims to promote security measures and boost EU member states’ level of protection of critical infrastructure. It tightens the requirements for information security in terms of confidentiality, integrity and availability.

Read more about the NIS Directive and NIS2!

The Cyber Resilience Act is for making sure that digital products that are on the market have sufficient cybersecurity. But, what is a product with digital elements, as stated in the act? It basically means a software or hardware product and its remote data processing solutions. By making regulations for the manufacturers, the hope is to limit the risk of cyberattacks against the user of the product.

What does the Cyber Resilience Act entail?

So far, no sectors or certain products with digital elements have been specified, but it might advance to this in the future. To mark that a product is following this regulation, it should be marked with the CE mark.

During the development of for example software, more focus is put on the design and development phase than the production phase. These points are included in the act:

Rules for putting products with digital elements on the market
Cybersecurity requirements for design, development, and production of products with digital elements
Requirements for handling vulnerabilities
Rules on market surveillance

How can you follow the Cyber Resilience Act?

When manufacturing a product, the manufacturer needs to make a cybersecurity assessment of the product. This assessment should be taken into account during the design, development and production phases, as well as for delivery and maintenance. The aim is to minimise cybersecurity risks and preventing incidents and consequences of those incidents.

It is also of importance to keep in mind that alterations can change the digital element of the product, so you must make sure that the alterations fit the requirements of the Cybersecurity Resilience Act. The product should be secure and follow the criteria both at the point of being put on the market, but also during its whole lifetime. Therefore, there must be requirements as to how vulnerabilities and cybersecurity requirements should be adapted further to the type of product that is produced.

In short, the cybersecurity element must be considered during the whole process of a product, from design to end of support and termination of the product.

Reporting and incidents

If a manufacturer of a product with digital elements finds out about an actively exploited vulnerability in the product, they must without delay report the vulnerability to The European Union Agency for Cybersecurity (ENISA). It must be reported within 24 hours of finding the vulnerability. If a manufacturer becomes aware of an incident that affects the security of the product – this should also be reported to ENISA within 24 hours. The manufacturer is also obliged to inform the users of the product of the incident and, if possible, suggest mitigating actions.

Fines

If you are not complying with the cyber resilience act, you risk large penalties – up to 15 000 000 EUR. The size of the fine is determined by the degree of non-compliance with the regulations, the severity of the consequences, the size of the manufacturer, and so on.

Do you want to know more about the NIS Directive?

Read about how to protect your digital information!

Data diodes – a security solution that is secure for many years

When choosing a security solution, there are many aspects to take into account. An important aspect is the lifetime of the solution you choose, that is, how long the solution will actually be as secure as when you bought it, regardless of what new threats and vulnerabilities that emerge. This is one of the reasons why you should choose data diodes as your security solution!

Why is it important to be able to trust digital information?

Today, much of the information we handle and take in is digital. But how do we know that we can trust the information we read? It is more important than ever that all organisations take responsibility for protecting their information, ensuring that it is accurate and trustworthy. In this blog post, you can learn why information security is so important and what you can do to protect your digital information!

Data diodes – the simple way to secure your valuable information

When NIS 2 becomes law and authorities will be able to carry out audits to see if organisations meet the requirements of the legislation, it is important to have good documentation of the technical solutions that safeguard your systems. Does your organisation have such clear documentation? The organisations that use data diodes to protect their sensitive information have a simple solution with a high level of security. This makes it easier to gain confidence in the security of the audited system which facilitates an audit and means, among other things, that you need less documentation. Maybe it is time to switch to data diodes?

This is how you motivate adding a data diode to your budget

Investing in sufficiently high security is never a mistake as it is more expensive to be exposed to a cyberattack. But it can, for different reasons, be a challenge to convince management to invest in security. It is sometimes wrongly considered to be both expensive and unnecessary. In this blog post, we will give you several arguments you can use to explain that a data diode is a simple solution with high security – well worth an investment.

Explore more

Find what you are looking for...