CRA and Third-Party Risks:Make your contracts CRA-ready.

The EU Cyber Resilience Act (CRA) introduces a fundamental shift in how manufacturers approach product cybersecurity. Compliance is no longer limited to securing the physical device. It requires a comprehensive understanding of all digital elements that contribute to a product’s functionality, security, and operation.

From embedded firmware and mobile applications to cloud services, APIs, and third-party software components, manufacturers must consider cybersecurity risks across the broader product ecosystem.

One of the most critical challenges is managing third-party supplier risks. While manufacturers remain responsible for meeting applicable CRA requirements, many security-critical components and services are developed or operated by external suppliers.

This makes supplier due diligence, clear contractual obligations, and continuous vulnerability management essential elements of CRA readiness.

Start with Product Context and Risk Assessment

Effective CRA compliance begins with a clear definition of the product and its intended use.

Manufacturers should establish the product’s Intended Purpose and Reasonably Foreseeable Use (IPRFU), including:

• Intended functionality and operating environment
• Target users, their technical capabilities, and usage scenarios
• Reasonably foreseeable use and misuse
• Potential cybersecurity threats and associated risks

These definitions form the foundation of a risk-based cybersecurity approach, helping manufacturers determine appropriate security controls without unnecessary overengineering or insufficient protection.

They also establish the basis for defining cybersecurity responsibilities across suppliers.

Define the Complete Product with Digital Elements (PwDE)

Under the CRA, manufacturers need to consider the complete Product with Digital Elements (PwDE) rather than focusing exclusively on the physical device.

Depending on the product architecture, the relevant scope may include:

• Embedded systems: Device firmware and embedded software
• Mobile applications: iOS and Android applications connected to the product
• Cloud infrastructure: Backend services, APIs, authentication, and identity management
• Third-party components: Software libraries, SDKs, open-source components, and managed services
• Update infrastructure: OTA updates, software signing, and distribution mechanisms

Particular attention should be given to Remote Data Processing Solutions (RDPS), including cloud-based processing and remote management functions that fall within the CRA’s product scope.

Clearly identifying these elements is essential for establishing cybersecurity responsibilities, conducting accurate risk assessments, and managing vulnerabilities throughout the product lifecycle.

Extend Cybersecurity Requirements to Suppliers

A common compliance challenge arises when manufacturers have extensive regulatory obligations but their supplier agreements do not reflect those requirements.

A practical solution is a back-to-back contractual approach, ensuring that relevant cybersecurity obligations are appropriately reflected in supplier agreements.

Depending on the supplier’s role and the product’s risk profile, manufacturers should consider requiring:

• Software Bill of Materials (SBOM): Visibility into software components across firmware, mobile applications, and relevant cloud services
• Hardware Bill of Materials (HBOM): Hardware components, suppliers, revisions, and support lifecycle information
• Risk assessment and threat modeling: Documentation of identified cybersecurity risks and mitigation measures
• Security testing evidence: Vulnerability assessment and penetration testing reports
• Conformity assessment support: Technical documentation and independent testing evidence where applicable

For cloud-based solutions, a Cloud-BOM or service inventory can provide additional visibility into microservices, container images, managed services, APIs, infrastructure configurations, and third-party SaaS integrations.

Maintaining an SBOM alone is not sufficient for comprehensive supplier risk management. Manufacturers also need processes to assess, monitor, and address risks arising from third-party components and services.

Prepare for CRA Vulnerability Reporting Requirements

The CRA’s vulnerability reporting obligations apply from 11 September 2026, making operational preparedness particularly important.

Manufacturers must establish processes for reporting actively exploited vulnerabilities and severe incidents affecting the security of their products within the applicable regulatory deadlines.

For relevant reportable events, the CRA establishes an early-warning deadline of 24 hours and a notification deadline of 72 hours, with further reporting obligations depending on the event.

Since manufacturers may depend on suppliers for technical information, supplier notification procedures should allow sufficient time to meet these obligations.

A practical contractual framework could establish the following supplier response targets:

• Within 12 hours: Initial notification of a relevant vulnerability or security incident
• Within 24 hours: Preliminary technical assessment, affected versions, and recommended mitigation measures
• Within 72 hours: Detailed technical findings, impact analysis, and corrective action plan

These are recommended supplier SLA targets, not statutory CRA reporting deadlines.

Manufacturers should also ensure that relevant suppliers provide designated security contacts, secure communication channels, forensic investigation support, and coordinated vulnerability disclosure procedures.

Maintain Compliance Through Change Management

Cybersecurity risks evolve as products, software components, and cloud infrastructures change.

Even relatively minor modifications, such as API authentication updates, cloud configuration changes, new SDK integrations, or additional third-party services, may affect a product’s security posture.

Supplier agreements should therefore address:

• Notification and approval procedures for security-relevant changes
• Continuous maintenance of SBOM and Cloud-BOM information
• Open-source component updates and applicable licence obligations
• Appropriate audit and penetration testing rights

Effective change management helps manufacturers maintain visibility over their product ecosystem and keep cybersecurity documentation aligned with actual product configurations.

Address Additional Requirements for Important and Critical Products

Products classified as important or critical under the CRA may be subject to additional conformity assessment requirements.

Depending on the product classification and applicable conformity assessment route, manufacturers may need additional technical evidence, third-party involvement, or support from a Notified Body.

Supplier agreements should therefore establish appropriate obligations for:

• Providing technical documentation and security testing evidence
• Supporting independent assessments where required
• Supplying relevant product samples, software builds, and technical information
• Addressing findings and implementing corrective actions

Early supplier involvement can help manufacturers avoid delays during conformity assessment.

How CyberWhiz Can Help

At CyberWhiz, we help manufacturers address CRA cybersecurity requirements across the complete product ecosystem, from embedded devices to mobile applications, cloud services, and third-party components.

Our Purple Team, Red Team, and Blue Team specialists support manufacturers through:

• CRA Gap Analysis and Risk Assessment: Defining product scope, identifying cybersecurity risks, and translating regulatory requirements into actionable security controls
• Product and Supply Chain Security: Supporting SBOM visibility, supplier risk assessments, and security requirements for third-party components
• Penetration Testing and Security Validation: Assessing embedded systems, mobile applications, APIs, and cloud infrastructure to identify vulnerabilities
• Vulnerability Management and Disclosure: Supporting vulnerability intake, verification, triage, coordinated disclosure, and regulatory reporting processes
• Compliance Documentation and Audit Readiness: Preparing technical evidence and supporting supplier cybersecurity requirements and contractual SLAs

Our CyberWhiz VDP Manager further helps manufacturers structure vulnerability disclosure and handling processes throughout the product lifecycle.

CRA compliance extends beyond the device. Your cybersecurity strategy should too.

Contact our team at [email protected] to discuss your CRA readiness and third-party cybersecurity risk management needs.