Annex B: Cyber Resilience Act essential requirements

in such a way that they ensure an appropriate level of cybersecurity based

on the risks.

Article 13(2) and where applicable, products with digital elements shall:

unless otherwise agreed between manufacturer and business user in

relation to a tailor-made product with digital elements, including the

possibility to reset the product to its original state;

including, where applicable, through automatic security updates that are

installed within an appropriate timeframe enabled as a default setting, with

a clear and easy-to-use opt-out mechanism, through the notification of

available updates to users, and the option to temporarily postpone them;

mechanisms, including but not limited to authentication, identity or access

management systems, and report on possible unauthorised access;

data, personal or other, such as by encrypting relevant data at rest or in

transit by state of the art mechanisms, and by using other technical

means;

personal or other, commands, programs and configuration against any

manipulation or modification not authorised by the user, and report on

corruptions;

limited to what is necessary in relation to the intended purpose of the

product with digital elements (data minimisation);

incident, including through resilience and mitigation measures against

denial-of-service attacks;

devices on the availability of services provided by other devices or

networks;

external interfaces;

using appropriate exploitation mitigation mechanisms and techniques;

internal activity, including the access to or modification of data, services or

functions, with an opt-out mechanism for the user;

permanent basis all data and settings and, where such data can be

transferred to other products or systems, ensure that this is done in a

secure manner.

identify and document vulnerabilities and components contained in

products with digital elements, including by drawing up a software bill of

materials in a commonly used and machine-readable format covering at

the very least the top-level dependencies of the products;

and remediate vulnerabilities without delay, including by providing security

updates; where technically feasible, new security updates shall be

provided separately from functionality updates;

with digital elements;

disclose information about fixed vulnerabilities, including a description of

the vulnerabilities, information allowing users to identify the product with

digital elements affected, the impacts of the vulnerabilities, their severity

and clear and accessible information helping users to remediate the

vulnerabilities; in duly justified cases, where manufacturers consider the

security risks of publication to outweigh the security benefits, they may

delay making public information regarding a fixed vulnerability until after

users have been given the possibility to apply the relevant patch;

vulnerabilities in their product with digital elements as well as in third-party

components contained in that product, including by providing a contact

address for the reporting of the vulnerabilities discovered in the product

with digital elements;

digital elements to ensure that vulnerabilities are fixed or mitigated in a

timely manner and, where applicable for security updates, in an automatic

manner;

security issues, they are disseminated without delay and, unless

otherwise agreed between a manufacturer and a business user in relation

to a tailor-made product with digital elements, free of charge,

accompanied by advisory messages providing users with the relevant

information, including on potential action to be taken.

1. Ülevaade

1.1 Viited

1.2 Tuvastatud nõuded

1.3 Seotud regulatsioonid

2. Tuvastatud nõuded

3. Seotud regulatsioonid

• ENISA -