Cybersecurity

Cybersecurity is what the Cyber Resilience Act (CRA) is ultimately for, and it is the one notion the Regulation does not spell out itself. Article 3, point (3), refers to Article 2, point (1), of Regulation (EU) 2019/881, the Cybersecurity Act. There it reads: cybersecurity means the activities necessary to protect network and information systems, the users of such systems, and other persons affected by cyber threats.

Activities, not a state

The definition describes cybersecurity as something done. It names no property a product either has or lacks, and no threshold above which something would count as secure. That explains how the Regulation is built, since much of it governs processes rather than features.

Article 13(2) requires the outcome of the risk assessment to be taken into account across six phases: planning, design, development, production, delivery and maintenance. Article 13(8) ties the vulnerability handling under Annex I, Part II to the whole Support period. A product therefore does not possess cybersecurity once and for all. It has it only for as long as the work behind it continues.

Three things being protected

The definition names three:

• network and information systems,
• the users of such systems,
• other persons affected by cyber threats.

The third reaches furthest. Protection is not confined to whoever operates your product. It extends to whoever an attack reaches through it. Annex I, Part I, point (2)(i) turns that into a requirement: products must minimise the negative impact by themselves or connected devices on the availability of services provided by other devices or networks. A device that can be conscripted into a botnet fails that requirement even if nothing happens to its owner.

What a network and information system is takes another chain of references. Article 2, point (2), of Regulation (EU) 2019/881 points to Article 4, point (1), of Directive (EU) 2016/1148, which Article 44 of the NIS2 Directive repealed with effect from 18 October 2024. References to it now read as references to the NIS2 Directive. Its Article 6, point (1), covers three things: electronic communications networks; devices or groups of devices carrying out automatic processing of digital data pursuant to a programme; and the digital data those elements store, process, retrieve or transmit for the purposes of their operation, use, protection and maintenance. The data are themselves part of what is protected, not just the machinery moving them.

Where the term does its work

Article 1 sets out the subject matter of the Regulation and ties its points (a) to (c) expressly to cybersecurity: rules for making products available on the market, essential requirements for design, development and production, and essential requirements for the vulnerability handling processes that run for the time the products are expected to be in use.

Article 6 and the Essential cybersecurity requirements turn that into a duty. Annex I, Part I, point (1) is the general clause: products shall be designed, developed and produced so that they ensure an appropriate level of cybersecurity based on the risks. Unlike the thirteen specific requirements in point (2), that sentence carries no “where applicable” qualifier.

A third place is easily missed. Article 13(5) requires due diligence when integrating components sourced from third parties so that they do not compromise the cybersecurity of the product, expressly including open-source components not made available on the market in the course of a commercial activity.

How much is enough is never stated absolutely

The Regulation gives no measure. What counts as appropriate follows from the assessment of cybersecurity risks, which Article 13(3) ties to intended purpose and reasonably foreseeable use, as well as the conditions of use, such as the operational environment or the assets to be protected. Only that assessment decides which of the requirements in Annex I, Part I, point (2) apply to a given product at all.

The yardstick becomes more tangible through the Presumption of conformity. Article 27 offers three routes to it: harmonised standards whose references are published in the Official Journal of the European Union, common specifications adopted by the Commission in implementing acts, and European cybersecurity certification schemes under Regulation (EU) 2019/881. Until harmonised standards exist, setting the yardstick stays with the manufacturer, and the reasoning belongs in the technical documentation.

What the term does not cover

Confidentiality, integrity and availability appear nowhere in the definition. That triad reaches the CRA by two indirect routes. The first runs through the Incident: Article 3, point (43), takes it from Article 6, point (6), of the NIS2 Directive, where it is defined as an event compromising the availability, authenticity, integrity or confidentiality of stored, transmitted or processed data or of the services offered by, or accessible via, network and information systems. The second runs through points (e), (f) and (h) of Annex I, Part I, point (2).

Cybersecurity is also distinct from safety. Article 13(2) names the health and safety of users expressly, as one respect in which the impact of incidents is to be minimised. The two are assessed together and remain different things.

The NIS2 Directive, finally, refers in Article 6, point (3), to the same definition. The notion is uniform across Union law; the subject matter is not. NIS2 binds entities in respect of the network and information systems they use for their operations or for the provision of their services, whereas the CRA binds manufacturers in respect of the product they place on the market.