CRA Security by Default: Secure Products Out of the Box

Secure by default under the CRA means digital products must ship with the most secure available configurations out of the box. Specifically, the CRA mandates: no weak default passwords, encrypted communication as the default setting, automatic installation of security updates (with opt-out option) and disabling of unnecessary services. The BSI describes this as the configuration principle where default settings must actively contribute to enhancing product security.

CRA requirements are phased in: from September 2026, manufacturers must report actively exploited vulnerabilities to ENISA and the relevant CSIRT within 24 hours. Full secure by default requirements under Annex I apply from December 2027 for all new products with digital elements placed on the EU single market.

Secure by design refers to integrating security throughout the entire product development process from the start. Secure by default concerns the delivery configuration: the product must be securely configured for the end user without requiring additional steps. The CRA requires both: security must be built into the architecture (by design) and default settings must provide maximum security (by default).

The CRA requires among others: prohibition of generic or weak default passwords, automatic security updates with opt-out option for users, separation of security and feature updates where feasible, encrypted communication as default, minimal attack surface through disabling unnecessary interfaces and services, secure authentication mechanisms and access controls out of the box.

Non-compliance with essential cybersecurity requirements including secure by default can result in fines of up to EUR 15 million or 2.5 percent of global annual turnover. Additionally, market surveillance authorities can order the recall of non-compliant products or prohibit their placement on the EU market.

Yes, secure by default applies to all three CRA product categories: standard products, important products (Class I and II) and critical products. The difference lies in the conformity assessment procedure: standard products may use self-assessment under Module A, while important and critical products require third-party assessment. The secure by default requirements themselves are identical across categories.

ADVISORI guides manufacturers from gap analysis through to CRA-compliant implementation: we assess existing default configurations against CRA Annex I, develop secure default profiles, support implementation of automatic update mechanisms, conduct penetration testing of factory settings and prepare technical documentation for the EU declaration of conformity.