Skip to main content

CRA Compliance Checklist for App & Software Developers

This checklist breaks down the Cyber Resilience Act (CRA) into practical steps for developers of general applications and software.

Phase 1: Planning and Design​

  • Perform Cybersecurity Risk Assessment (Article 13):
    • Analyze risks related to your app's function, the data it processes, and its operating environment.
    • Document the applicability of Annex I essential requirements.
  • Determine and Document Support Period (Article 13, Paragraph 8):
    • Set a support period for security updates (minimum 5 years or expected lifetime). Justify your decision in writing.

Phase 2: Development and Testing​

  • Follow Secure Development Lifecycle (SSDLC) Practices:
    • Implement secure coding standards (e.g., input validation, error handling).
    • Conduct security-focused code reviews.
  • Manage Dependencies with an SBOM (Annex I, Part II):
    • Generate and maintain a Software Bill of Materials (SBOM) for all third-party libraries, frameworks, and components.
    • Continuously scan dependencies for known vulnerabilities.
  • Implement Essential Security Requirements (Annex I, Part I):
    • Ensure secure by default configuration.
    • Implement robust access controls and authentication.
    • Protect confidentiality and integrity of data (e.g., using encryption for data at rest and in transit).
    • Design a secure and reliable update mechanism.
  • Perform Security Testing:
    • Run static analysis (SAST) and software composition analysis (SCA) tools in your CI/CD pipeline.
    • Conduct dynamic analysis (DAST) or penetration testing for higher-risk components.

Phase 3: Release and Ongoing Maintenance​

  • Establish Vulnerability Management Processes (Annex I, Part II):
    • Publish a Coordinated Vulnerability Disclosure (CVD) policy.
    • Set up a clear channel for security reporting (e.g., [email protected]).
  • Prepare All Compliance Documentation (Annex VII):
    • Assemble your Technical Documentation, including the risk assessment, SBOM, test reports, and DoC.
  • Formally Declare Conformity (Annex V):
    • Draw up and sign the EU Declaration of Conformity.
  • Apply the CE Marking (Article 30):
    • Affix the CE mark digitally (on your website or DoC).
  • Respond and Patch "Without Delay" (Annex I, Part II):
    • Have a process to triage, fix, and deploy security updates for free.
  • Fulfill Mandatory Reporting (Article 14):
    • Be prepared for the 24/72-hour reporting deadlines for actively exploited vulnerabilities or severe incidents.

Key Takeway​

CRA compliance for app developers hinges on a secure development lifecycle, rigorous dependency management via an SBOM, comprehensive documentation, and a robust, ongoing vulnerability handling process.