Practical notes on the Cyber Resilience Act
Short, practical posts on the EU's new cyber law: what to report, what is inside your product, and which group it falls in.
· 3 min read
Open source under the Cyber Resilience Act: who carries what
The Cyber Resilience Act looks at what you do with open source, not at the licence. Publishing, building it into a product, selling it, stewarding it.
- scope
- open source
- components
· 3 min read
What the Cyber Resilience Act fines are, and what else can happen
The three bands of Cyber Resilience Act fines, what each is for, why they are ceilings rather than prices, and the consequences that are not fines.
- enforcement
- what to do first
· 3 min read
Your name on someone else's product: what the Cyber Resilience Act asks
Selling a product made by someone else under your own brand makes you its manufacturer under the Cyber Resilience Act, reporting included. What to do.
- scope
- suppliers
- reporting
· 3 min read
How long you must support a product under the Cyber Resilience Act
The Cyber Resilience Act makes you set a support period, print it, and fix vulnerabilities until it ends. How long it must be, and how to choose it.
- updates
- product life cycle
- what to do first
· 3 min read
Every Cyber Resilience Act date that matters
The Cyber Resilience Act arrives in stages. Every date in it, what each one means for a manufacturer, and the dates the Act leaves for you to set.
- reporting
- scope
- what to do first
· 3 min read
Does the Cyber Resilience Act cover software and SaaS?
Software is a product under the Cyber Resilience Act, free or paid. A cloud service alone is not, unless it is part of a product. Where the line is.
- scope
- software
· 7 min read
Ordinary, important or critical: which group is your product in?
Ordinary, important or critical: the group decides who checks your work. Six steps to a defensible answer, and the record that makes it stick.
- product groups
- CE marking
- scope
· 7 min read
The reporting duty has started: six things to do in a week
The CRA reporting duty now applies. Six things to put in place in a week: a way to receive reports, a plan keyed to the legal clocks, one rehearsal.
- reporting
- what to do first
- components
· 6 min read
Can you say what is inside your product?
Most small companies surveyed keep no list of the software inside their own product. Why that list comes first, and how to get one.
- components
- suppliers
- build system
Not sure where you stand?
Eight short steps, and you find out whether the law reaches your product.