2 Security by Design: Essential CRA Requirements

The requirements outlined here are meant to guide evaluation and decision-making. Which requirements are to be implemented or not should be determined based on a full understanding of the risks involved.

No Known Exploitable Vulnerabilities

Products available on the market should not have any known exploitable vulnerabilities. Chapter I, Article 3 (41) of the CRA defines “exploitable vulnerability” as a vulnerability that has the potential to be effectively used by an adversary under practical operational conditions. Any vulnerabilities that can only be exploited in non-practical conditions (i.e. like in a lab or test mode) are not included in this category.

Secure by Default

A product should be in a secure configuration by default and must allow the possibility of resetting the product to its original state, unless otherwise agreed upon by the parties involved.

Automatic, Timely Security Updates

Manufacturers must ensure that all vulnerabilities are addressed through security updates throughout the support period of the product. These updates must be free of charge and, if technically feasible, enabled by default with clear information and opt-out and postponement mechanisms. If updates are not feasible, the justification must be documented implicitly in the compliance documentation.

Protection from Unauthorized Access

Access to the product must be ensured through authentication, identity, or access management mechanisms. Similarly, the firmware running on devices should also be verified and validated.

Data Anonymity and Integrity Protection

Based on the risk assessment and the environment, products must protect the confidentiality, anonymity, and integrity of stored, transmitted, or processed data, personal or otherwise, through appropriate state-of-the-art mechanisms.

Data Minimization

Products must process only data that is adequate, relevant, and necessary for the intended purpose. Access to data and functions should also follow the principle of least privilege.

Safe and Secure Recovery from Incidents

The essential and basic functions of a product should remain available after an incident. Similarly, a failure in the product should be isolated and should not impact the product itself or any connected products.

Minimized Attack Surfaces

An attack surface is the total sum of all vulnerabilities, entry points, and pathways—digital, physical, and human—that an unauthorized user can exploit to access or extract data from a system. Minimizing these entry points is an essential first step towards a more secure product.

Data Monitoring

Internal activity relevant to security-related information, such as access to and modification of data, must be monitored, with an opt-out mechanism.

Easy Data Deletion and Migration

Users must be provided with an option to easily, securely, and permanently remove all data and settings they have on the product. Similarly, if the data is to be migrated to other products and systems, this should be performed in a secured way.

• Identify the risks associated with the product. Which of these requirements address these risks?
• Assess the product for any known vulnerabilities by searching common vulnerability databases, such as the European Vulnerability Database or the global Common Vulnerabilities and Exposures (CVE) database.
• Check if the default configuration of the device or product is secure.
• Review plans for providing security firmware updates to customers.
• Understand how the product is protected from unauthorized access. If not, how can it be protected?
• Be familiar with how the product handles user data:
  • What data is being gathered by the product, and how much?
  • Does it anonymize the data?
  • What measures are taken to protect the integrity and confidentiality of the data?
  • Can users easily delete, download, or migrate their data?
• Simulate a worst-case attack on the product and identify the impacts of a security fault on the product and on any connected device.