The Cyber Resilience Act (CRA), adopted by the European Union on October 10, 2024, with enforcement set for October 2027, represents a monumental shift in the landscape of digital product security and especially IoT. Much like the General Data Protection Regulation (GDPR) redefined data privacy, the CRA promises to have a far reaching impact on how digital products and services are designed, developed and distributed. For CISOs, the CRA is both a challenge and an opportunity, a possibility to embed resilience and security into organizational practices while maintaining compliance.

Stronger together | Europe’s vision for a resilient digital ecosystem

The CRA is urgently needed to address the persistent market failure in the domain of cyber security, where manufacturers often prioritize cost and speed over security, leaving internet connected devices vulnerable to digital threats. This imbalance creates a cascade of risks as insecure products expose individuals, businesses and critical infrastructure to cyber attacks. Governments are stepping in to create a safer digital world by enforcing accountability across the complete supply chain, ensuring that security is no longer an afterthought. The EU is leading the charge in creating a safer digital world, setting the standard with cyber security-by-design principles and promoting transparency. EU is setting again the standard with demonstrating leadership by mandating cyber security- by-design principles, enhancing transparency and paving the way for a harmonized regulatory framework.

Cyber Resilience Act Compliant Today, Exposed Tomorrow

1

Key parallels between CRA and GDPR include:

• Global reach: While targeting EU markets, both regulations compel non-EU organizations to comply if their operations touch EU consumers or businesses.

• Substantial penalties: The CRA mandates fines of up to €15 million or 2.5% of global turnover for non-compliance, rivalling GDPR’s financial impact.

• Operational overhaul: Organizations must revamp product designs, internal processes and supply chain practices to meet strict criteria.

• Cultural shift: Like GDPR, the CRA drives a change in mindset, emphasizing security by design and accountability across the product lifecycle.

A regulatory force comparable to GDPR

The CRA is crucial for addressing the persistent challenges within the cyber security landscape, particularly in the highly competitive IoT market. Manufacturers, driven by the need to be first to market with innovative features, often prioritize cost reduction and rapid product development to stay competitive. Striking a balance between cost and functionality is an ongoing challenge, but this approach can inadvertently compromise security, leaving internet-connected devices exposed to significant cyber threats. The problem is made worse by how hard it can be to set up strong cyber security controls, the lack of clear rules for the industry, and the fact that many consumers are not aware of the risks. These issues make it clear that regulations are needed to create a safer and more secure digital world.

The CRA’s impact is expected to rival that of GDPR, with implications that transcend EU borders. Affecting not just European organizations but any entity intending to do business in the EU. Similar to how GDPR became a global benchmark for data privacy, the CRA is a first attempt to set a standard globally for cyber security requirements on manufacturers of digital products (encompassing all internet-connected devices, software, and hardware) and their supply chains. The ripple effects include heightened compliance costs, accelerated innovation cycles and significant global market influence.

2

Understanding the CRAs scope

The CRA introduces mandatory cyber security requirements for all products with digital elements sold within the EU. It divides products into risk classes: Class I and II, with stricter requirements for critical systems and networks. Open-source software is generally exempt unless incorporated into commercially marketed products.

Key CRA objective include:

1. Reducing security risks: Mandating lifecycle security and robust supply chain oversight.

2. Ensuring accountability: Making organizations liable for addressing vulnerabilities, even after products are sold (post-sale).

3. Promoting transparency: Requiring disclosures of security features and risks across all components in the complete supply chain.

4. Harmonizing standards: Setting consistent cyber security standards across the EU market.

5. Sanctioning non-compliance: Imposing hefty penalties for violations, compelling strict adherence.

CRA’s profound organizational impact

Like GDPR, the CRA will be a disruptive force. Its implementation will create challenges across all industries, creating both challenges and opportunities.

1. Economic pressure: The CRA will require significant investment in compliance frameworks, likely increasing product costs. For example, IoT device manufacturers may need to retrofit or replace existing product lines to meet security standards.

2. Global influence: Companies operating outside the EU may feel pressured to adopt CRA principles, similar to how GDPR reshaped global data privacy practices.

3. Innovation accelerator: Meeting CRA standards will drive security-focused innovation, forcing companies to design robust, resilient products to gain a competitive edge.

4. Supply Chain evolution: Organizations will need to implement tighter supply chain controls, potentially disrupting traditional vendor relationships and increasing reliance on third-party assessments.

5. Enhanced consumer trust: Like GDPR’s impact on consumer data transparency, the CRA is poised to enhance customer trust in secure, resilient digital products.

Unintended impact of the CRA While its overarching goals are clear, the CRA introduces subtle yet significant challenges:

1. Shadow IT risks: Users might be tempted by cheaper, non-compliant products, increasing risks of unauthorized and insecure devices entering the enterprise ecosystem.

2. Pressure on “grey” imports: Non-compliant products from outside the EU will face stricter import regulations, potentially limiting technology options and inflating prices.

3. Legacy systems dilemma: Organizations must decide between costly retrofits to align older devices with CRA requirements or complete replacement of outdated systems.

3

Strategic actions for CISOs

To thrive under the CRA’s regulatory framework, CISOs now have the time to adopt proactive strategies. The time is now ideal as those actions can provide a strong foundation.

• Starting with comprehensive audits. A beginning could be a full assessment of products, processes and supply chains to identify compliance gaps.

• Another action could be to engage with Supply Chain partners. Learn how third-party vendors will comply with CRA requirements through contract stipulations and regular security evaluations.

• Lastly, leverage harmonized standards. Alignment with EU-approved cyber security benchmarks will help to streamline compliance and achieve certifications faster.

Lessons from GDPR | Transforming compliance into opportunities

1. Proactive investment saves costs: Early adopters of GDPR-aligned processes reaped the benefits of reduced penalties and smoother integration. Similarly, CRA compliance is best tackled well ahead of deadlines.

2. Reputation and trust building: Compliance signals reliability, fostering trust among consumers and stakeholders.

3. Innovation as a differentiator: Use compliance efforts to advance product innovation, positioning security as a value-add for consumers.

© 2025 Check Point Software Technologies Ltd. All Rights Reserved.

Conclusion

The CRA reaches far beyond manufacturing and affects every player in the value chain, from service providers to end users. The manufacturing industry is reporting that customers are often unwilling to pay for security, while customers in turn are reporting that suppliers sometimes present security as a sales driver. This underscores a broader problem: the lack of effective communication about the importance of cyber security and its benefits. The CRA is poised to become the next regulatory cornerstone, shaping the future of secure digital products much like GDPR transformed data privacy. While compliance may appear challenging, it offers an opportunity to drive innovation, build consumer trust, and secure a leadership position in global markets. CISOs who choose to act proactively can view the CRA not only as a regulatory requirement but also as a strategic opportunity for strengthening their cyber security posture.With early alignment, organizations can navigate its complexities effectively, mitigating risks and solidifying their place in a safer, more resilient digital ecosystem.