Products must meet 13 guidelines
Under the CRA, all products with a software component will have to meet 13 guidelines. These cover a range of requirements on how they handle any data that is created during use, how that data is kept private, and security for the software itself. The product itself should be resilient and with a limited attack service. This includes standard best practices like ensuring that the default configuration for any product is secure, that unauthorized access is not possible, and that data is held securely. Most importantly, the software implemented on any device should be capable of being updated to a more secure version.
The rules also cover the data itself and how it can be managed over time. For example, if the customer wants to delete their data from a device, they should be able to do so. Similarly, they should be able to copy or move their data off the product, rather than being locked into that service. Companies also are encouraged to avoid capturing data that they don’t need to provide the service. The biggest hurdle for software teams is that their products should launch without any known vulnerabilities. While there may be something in the product that is faulty and discovered later, a clean software bill of materials will be essential.
What software providers are responsible for
The software bill of materials, or SBOM, is a list of all the components and code libraries that an application relies on to function. For the regulator, that list will prove that you have checked everything that is in place and whether it is secure at release.
