Skip to main content

CRA Compliance Checklist for Game Developers

This checklist translates the Cyber Resilience Act (CRA) into actionable items for game development.

Phase 1: Pre-Development and Design​

  • Conduct a Cybersecurity Risk Assessment (Article 13):
    • Identify risks to your game, its players, and their data (e.g., account takeover, cheating, backend server exploits).
    • Document how Annex I requirements apply to your game.
  • Define and Document Support Period (Article 13, Paragraph 8):
    • Decide how long you will provide security updates (at least 5 years, or expected lifetime). Document your reasoning.

Phase 2: Development​

  • Secure Coding Practices: Train your team on secure coding, especially for handling player data, authentication, and communication with backend services.
  • Manage Dependencies Securely (Annex I, Part II):
    • Create and maintain a Software Bill of Materials (SBOM) for your game engine, plugins, and all libraries.
    • Check dependencies for known vulnerabilities.
  • Implement Security Features (Annex I, Part I):
    • Secure player authentication and data storage.
    • Protect the integrity of save games and in-game assets where critical.
    • Implement secure by default settings.
    • Design a secure update mechanism (often handled by platforms like Steam or app stores).

Phase 3: Release and Post-Launch​

  • Establish a Coordinated Vulnerability Disclosure (CVD) Policy (Annex I, Part II):
    • Create a public policy and a clear channel for security researchers to report issues (e.g., [email protected]).
  • Compile Technical Documentation (Annex VII):
    • Gather your risk assessment, architecture diagrams, SBOM, test reports, and user instructions into one file.
  • Create the EU Declaration of Conformity (DoC) (Annex V):
    • Formally declare your game complies with the CRA.
  • Affix CE Marking (Article 30):
    • Place the CE mark on your website or DoC.
  • Monitor and Patch Vulnerabilities (Annex I, Part II):
    • Have a process to assess and fix new vulnerabilities "without delay".
    • Provide security updates for free throughout the support period.
  • Mandatory Reporting (Article 14):
    • Be ready to report actively exploited vulnerabilities or severe incidents to authorities within the required timelines.

Key Takeway​

For game developers, CRA compliance means integrating security from the design phase, managing your engine and library dependencies, and having a solid plan for security updates and vulnerability reports post-launch.