What the Cyber Resilience Act means for you
The Cyber Resilience Act (CRA) is the EU’s new baseline for secure-by-design software and hardware. Any product with digital elements sold in the EU — from backend services and SaaS applications to consumer IoT, industrial systems, and embedded devices must meet strict security, update, and transparency requirements.
The regulation enters into force gradually between 2025 - 2027.
Key CRA obligations for manufacturers
CRA requires you to demonstrate continuous security throughout the entire lifecycle of a product. The core obligations include:
Secure-by-design development
Apply secure engineering principles from concept → development → deployment
Maintain technical documentation proving how security risks were addressed
Provide a Software Bill of Materials (SBOM)
Lifecycle security
Monitor vulnerabilities continuously
Provide free and timely security updates for the entire support period
Ensure default configurations are secure out-of-the-box
Maintain event logging and detect misuse or abnormal behavior
Vulnerability & incident handling
Report actively exploited vulnerabilities to ENISA within 24 hours
Report significant security incidents within 24 hours
Notify users of mitigations and available patches
Publish vulnerability disclosures in a transparent way
Compliance & CE marking
Perform a risk assessment and classify products (default, critical, highly critical)
Complete conformity assessments and maintain evidence
Affix CE marking to demonstrate CRA compliance
Allow audits where required for higher-risk categories
Most companies underestimate the ongoing requirements: continuous monitoring, runtime insights, and keeping security documentation fresh.
How bifrost helps you comply with CRA
bifrost enables software teams to meet the continuous security and transparency requirements of CRA without slowing down release cycles.
Continuous secure-by-design enforcement
bifrost learns the intended behavior of each workload during runtime and generates a tailored security profile. This ensures the application only performs expected actions, a practical enforcement of secure-by-design and least privilege throughout its lifecycle.
Automatic updates → automatic security profile refresh
Every new build or patch triggers an updated behavior profile directly in your CI/CD pipeline, ensuring that updates required by CRA do not introduce new risk.
Vulnerability handling & incident reporting
bifrost detects abnormal behavior in real time and surfaces evidence needed for:
ENISA vulnerability reporting
Incident disclosure
Compliance documentation
Proving misuse detection and logging (CRA requirement)
With bifrost, monitoring and enforcement become automated, helping you stay compliant without adding manual overhead.
Compliance doesn’t need to slow you down. bifrost keeps you secure, transparent, and ready for CRA.
Discover how bifrost can help your organisation