They're coming to regulate you!
summary
EU Cyber Resilience Act (CRA) obliges manufacturers to certify software with essential security requirements, requires reporting actively exploited vulnerabilities to authorities within 72 hours, and threatens fines up to 2.5% of global turnover. About 90% of products face self‑assessment, critical classes require testing, and open source (≈80% of systems) still falls under manufacturer responsibility. Expect mandatory SBOMs, free security updates, supply‑chain documentation, and a production stop if an exploited vulnerability cannot be mitigated.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:49Why regulation now
- 6:29Markets failing governments
- 10:20Cyber Resilience Act scope
- 13:56Manufacturers' obligations
- 19:14Hardware vulnerabilities
- 23:10Act timeline phases
- 27:50Documentation and certification
- 29:55Open source and CRA
- 34:09Secure by Design lifecycle
- 37:19SBOM and vulnerability tracking
- 41:11Summary and next steps
related talks
27mEU Cyber Resilience Act: What Every Manufacturer Needs to Know
32mThe EU Cybersecurity Resilience Act (CRA) - Boring, Scary or Exciting?
30mThe EU's Cybersecurity Resilience Act (CRA) has Begun – How Can Manufacturers Confidently Addres ...
39mCherry Blossom and Compliance - An Intro To the EU CRA
22mEU Cyber Resilience Act - A Product Owner’s Approach
53mHow To Stay Compliant With and Take Benefits From the EU CRA (Cyber Resilience Act)
59mMerging Security and Compliance: Perspectives on Emerging Regulations and Best Practices
33mImplementing the EU Cyber Resilience Act (CRA)