CRA Cyber Resilience Act - Vulnerability Management

The CRA makes vulnerability handling a mandatory, lifecycle-long duty for manufacturers of products with digital elements.

🔍 Key obligations include:

Manufacturers must report actively exploited vulnerabilities in their products as well as severe incidents affecting product security. Reporting follows a staged model: an early warning within

24 hours of becoming aware, a more detailed notification within

72 hours, and a final report within

14 days of a corrective measure becoming available. Reports are submitted via a single reporting platform and reach the designated CSIRT and ENISA. These reporting obligations apply from September

2026 — ahead of the CRA's remaining requirements — making them the most urgent work stream for most manufacturers. Meeting a 24-hour deadline reliably requires prepared capabilities: clear internal escalation paths, defined PSIRT roles, report templates and rehearsed criteria for classifying a vulnerability as actively exploited. We build and test exactly these capabilities with you.

The CRA obliges manufacturers to establish and publish a coordinated vulnerability disclosure (CVD) policy. In practice this means providing a clearly communicated contact point through which security researchers and other third parties can report vulnerabilities, ensuring reports are received securely, triaged and acknowledged, and coordinating remediation and publication timelines with the reporter. A functioning CVD process is more than a compliance checkbox: it channels external security research into your remediation pipeline before vulnerabilities are exploited or disclosed publicly without warning. We design CVD policies and intake workflows, integrate them with your PSIRT and ticketing landscape, and define decision rules for disclosure timing — so external reports strengthen your product security instead of triggering ad-hoc crisis management.

Yes — under the CRA, security updates must be provided free of charge and without undue delay for the duration of the product's support period. The support period must reflect the time the product is reasonably expected to be in use and is generally at least five years, unless the expected product lifetime is shorter. Manufacturers must state the support period transparently, and security updates should be provided separately from functional updates wherever technically feasible, so users are not forced to accept new features to stay secure. For product planning this has real commercial consequences: support commitments, update infrastructure and end-of-life communication need to be priced and planned per product line. We help you define support periods and update strategies that are both compliant and economically sustainable.

We cover the full path from assessment to operational capability. Starting with a gap analysis of your current vulnerability management against CRA requirements, we design the target processes: vulnerability identification and SBOM management, risk-based prioritization, patch management, coordinated disclosure and the ENISA reporting workflow. We support PSIRT setup with defined roles and escalation paths, implement automated scanning and assessment tooling integrated into your development pipeline, and establish continuous compliance monitoring with meaningful KPIs. Where useful, we run tabletop exercises that rehearse the 24-hour reporting scenario end to end. The result is a vulnerability management system that scales across your product portfolio and produces the documentation auditors and market surveillance authorities expect.

The consequences operate on several levels. Violations of the essential requirements, including vulnerability handling obligations, can be fined with up to EUR

15 million or 2.5% of global annual turnover, whichever is higher. Beyond fines, market surveillance authorities can order corrective actions, restrict availability or require products to be withdrawn or recalled from the EU market — for most manufacturers a far greater commercial risk than the penalty itself, since CRA conformity is a condition for CE marking and thus for market access. Added to this are reputational damage and potential liability exposure if unpatched vulnerabilities lead to customer incidents. Early, systematic implementation is therefore not only a compliance duty but protection of your EU revenue base.