+Annex C: Mapping security principles to Cyber Resilience Act essential requirements

Annex C: Mapping security principles to Cyber Resilience Act essential requirements

PrincipleCRA essentialImplementation support

requirement

Trust boundaries and threat modellingANNEX-1.PT1.1Supports identification and assessment of cybersecurity risks by making trust assumptions, assets and attack paths explicit during design
ANNEX-1.PT1.2.dSupports protection from unauthorised access by clarifying where authentication and access controls are required between trust boundaries
ANNEX-1.PT1.2.eSupports confidentiality protections by identifying where data crosses trust boundaries and requires protection
ANNEX-1.PT1.2.fSupports integrity protection by identifying where data, commands or configuration cross boundaries and may require integrity controls
ANNEX-1.PT1.2.jSupports attack surface limitation by identifying exposed interfaces and unnecessary trust relationships
Least privilegeANNEX-1.PT1.2.dSupports protection from unauthorised access by limiting what authenticated users, services and processes are permitted to access or perform
ANNEX-1.PT1.2.fSupports integrity protection by limiting which identities are authorised to modify data, programs or configuration
ANNEX-1.PT1.2.gSupports data minimisation by limiting access to data to what is necessary for the intended purpose
Strong identity and authentication architectureANNEX-1.PT1.2.dSupports access protection by defining how identities are authenticated and managed across interfaces
ANNEX-1.PT1.2.lSupports logging and monitoring of authentication and access-related activity
Attack surface minimisationANNEX-1.PT1.2.bSupports secure by default configuration by reducing enabled features and services at initial deployment
ANNEX-1.PT1.2.jSupports attack surface limitation by reducing unnecessary interfaces, services and exposed functionality
Defence in depthANNEX-1.PT1.2.hSupports availability and resilience by relying on multiple layers of protection rather than a single control
ANNEX-1.PT1.2.kSupports impact reduction by applying multiple mitigation mechanisms that limit the effect of exploitation
Open designANNEX-1.PT2.3Supports effective testing and review by using designs that can be examined and assessed
ANNEX-1.PT2.4Supports vulnerability disclosure by aligning with transparent communication of security issues and fixes
Life-cycle managementANNEX-1.PT1.2.cSupports the ability to address vulnerabilities over the product lifetime through updates
ANNEX-1.PT1.2.mSupports secure decommissioning by providing mechanisms to remove data and settings at end of use
ANNEX-1.PT2.2Supports timely remediation of vulnerabilities throughout the supported life cycle
ANNEX-1.PT2.7Supports controlled and secure distribution of updates over time
User-centric designANNEX-1.PT1.2.bSupports secure by default configuration that users can reasonably adopt and maintain
Secure coding and verification practicesANNEX-1.PT1.2.aSupports release without known exploitable vulnerabilities by identifying and addressing issues during development
ANNEX-1.PT2.1Supports identification and documentation of vulnerable components during development
ANNEX-1.PT2.3Supports regular testing and review of product security during development and before release
Logging, monitoring and alertingANNEX-1.PT1.2.dSupports detection and reporting of unauthorised access attempts
ANNEX-1.PT1.2.lSupports recording and monitoring of security-relevant internal activity
Configuration and change managementANNEX-1.PT1.2.fSupports protection of configuration integrity by controlling, reviewing, and rolling back configuration changes.
ANNEX-1.PT1.2.dSupports protection from unauthorised access by restricting who can deploy or modify configurations, particularly in production environments
Incident response and recoveryANNEX-1.PT1.2.hSupports recovery and continued availability of essential functions after incidents
ANNEX-1.PT1.2.kSupports reduction of incident impact through prepared response and mitigation actions
Vulnerability and patch managementANNEX-1.PT2.1Supports identification and tracking of vulnerable components and dependencies throughout the product life cycle
ANNEX-1.PT2.2Supports timely triage and remediation of identified vulnerabilities based on risk
ANNEX-1.PT2.4Supports public disclosure of fixed vulnerabilities
ANNEX-1.PT2.5Supports coordinated handling and disclosure of vulnerabilities
ANNEX-1.PT2.6Supports mechanisms for receiving vulnerability reports from external parties
ANNEX-1.PT2.7Supports secure distribution of patches and updates
ANNEX-1.PT2.8Supports timely dissemination of security updates and related user guidance
Supply-chain controlsANNEX-1.PT1.2.aSupports reduction of exploitable vulnerabilities introduced through compromised components
ANNEX-1.PT2.1Supports transparency of components and dependencies through SBOM generation
ANNEX-1.PT2.7Supports secure distribution of updates through protected build and release channels
Minimisation of default servicesANNEX-1.PT1.2.bSupports secure by default configuration by disabling non-essential features and services at initial deployment
ANNEX-1.PT1.2.iSupports minimising negative impact on other services by disabling non-essential functionality that could otherwise be abused or misused
ANNEX-1.PT1.2.jSupports limitation of attack surfaces by reducing exposed services and interfaces by default
Restrictive initial accessANNEX-1.PT1.2.bSupports secure by default access settings by avoiding permissive initial credentials and permissions
ANNEX-1.PT1.2.dSupports protection from unauthorised access by enforcing restrictive authentication and access-control settings at first use
Secure communication by defaultANNEX-1.PT1.2.bSupports secure by default configuration by enforcing encrypted and authenticated communications from initial connection
ANNEX-1.PT1.2.eSupports confidentiality of transmitted data by applying encryption to communications from first use
ANNEX-1.PT1.2.fSupports integrity protection of transmitted data by preventing unauthorised modification of data in transit
Unique device identity and secrets by defaultANNEX-1.PT1.2.bSupports secure by default configuration by avoiding shared credentials and shared cryptographic material
ANNEX-1.PT1.2.dSupports protection from unauthorised access by avoiding shared credentials and enforcing unique device authentication
ANNEX-1.PT1.2.eSupports confidentiality by preventing reuse or leakage of shared secrets across devices
Mandatory security onboardingANNEX-1.PT1.2.bSupports secure by default configuration by requiring critical security features to be configured before initial exposure
ANNEX-1.PT1.2.dSupports protection from unauthorised access by ensuring that authentication and access controls are configured at first use
Automated maintenance and updatesANNEX-1.PT1.2.bSupports a secure by default posture by enabling automatic security updates
ANNEX-1.PT1.2.cSupports the ability to address vulnerabilities through automatic security updates enabled by default
ANNEX-1.PT2.2Supports timely remediation of vulnerabilities by reducing reliance on manual patch deployment
ANNEX-1.PT2.7Supports secure and timely distribution of security updates by enabling automated update mechanisms
Transparent security postureANNEX-1.PT1.2.bSupports secure by default configuration by guiding users back to a secure baseline when insecure choices are made
ANNEX-1.PT1.2.lSupports security-related information by informing users of security-relevant state changes and risks
Secure recovery and ownership life cycleANNEX-1.PT1.2.bSupports secure by default configuration by providing safe recovery and reset paths that restore a secure baseline
ANNEX-1.PT1.2.dSupports protection from unauthorised access during recovery, reset and ownership transfer processes
ANNEX-1.PT1.2.mSupports secure removal of data and settings during factory reset, decommissioning or ownership transfer

1. Yleiskatsaus

1.1 Viittaukset

1.2 Tunnistetut vaatimukset

1.3 Liittyvät säädökset

2. Tunnistetut vaatimukset

Vaatimukset

3. Liittyvät säädökset

Säädökset