Getting ready for Cyber Resilience Act

The Cyber Resilience Act is a European Union law establishing mandatory cybersecurity standards and lifecycle vulnerability-handling requirements for all hardware and software products with digital elements placed on the EU market. With Cyber Resilience Act's first deadline approaching on September 11th, we have prepared an outline of the necessary actions required at this stage.

Since most of our clients have a mobile app installed on the user's device that connects to a remote service, the mobile apps and backend are all separate products that fall within the scope of the Cyber Resilience Act. In the case of our clients, since the client is the owner of the platform, the client would be the manufacturer and Vioside would be the authorised representative.

This first deadline enforces reporting obligations within 24 hours of discovering an actively exploited vulnerability. These are security vulnerabilities exposed on the product through its code, or code of installed third-party dependencies/plugins that are reportedly being exploited by hackers. This therefore requires proper vulnerability discovery. We are taking two approaches:

• Providing security researchers with the industry standard documentation on the client's website on how to report a vulnerability. This is done with a Security Vulnerability Disclosure policy and a security.txt page on the website.
   
• ​Automation to get notified of dependencies used by the product that have actively exploited vulnerabilities reported.

​I​f a vulnerability is reported to Vioside as the authorised representative, we will immediately inform the client and perform the necessary troubleshooting, analysis and reporting required by the CRA.

The above procedures may of course vary according to the nature of the client. If the client has a backend system or website managed by themselves, it may make sense for certain procedures mentioned above to be performed by the manufacturer directly. However, at Vioside, we're happy to help in every step of the way as needed.

The next deadline is December 11th, 2027, which would require us to formally mandate the authorised representatives​, prepare documentation and procedures, and perform ​the necessary audits ​and risk assessments in order to obtain the CE marking. ​A self-assessment should suffice in most cases depending on how critical the platform is.