The Cyber Resilience Act (CRA) integrates cybersecurity requirements into the entire lifecycle of products and software that contain digital components. Reporting obligations will take effect on September 11, 2026, and the CRA will apply broadly from December 11, 2027.
However, meeting CRA requirements takes more than an analysis or a report. The requirements must be integrated into the product and into the day-to-day practices of product development.
At Wirokit, we help make this a reality. We integrate secure software development practices into product development and help build the necessary solutions for vulnerability management, updates, component tracking, testing, and documentation.
The CRA requires that a product’s cybersecurity be managed from design through development, maintenance, and decommissioning.
In practice, a company must be able to identify cybersecurity risks associated with the product, prevent vulnerabilities already during the development phase, maintain the product’s security, and provide documented evidence of the measures taken.
“We need to move away from the idea that security can be added later. It needs to be part of product development from the very beginning.”
- Mika Maunumaa, Senior Software Engineer
CRA emphasizes the "Secure by Design" and "Secure by Default" approaches. Cybersecurity must be built into the product’s specification, architecture, and development—for example, through threat modeling, minimizing the attack surface, and secure software development practices. Learn more about the "Secure by Design" approach.
It must be possible to receive, assess, fix, and communicate product vulnerabilities in a controlled manner. At the same time, secure updates for the product must function throughout the entire defined support period.
The components, libraries, and third-party software used in products must be identified, and their security must be monitored.
Managing SBOM data and vulnerability information helps you quickly determine whether, for example, a new known vulnerability affects your product.
The CRA requires product-specific risk management, technical documentation, and evidence of the safety measures taken.
Testing, decisions, controls, and other evidence must together demonstrate that the product meets the applicable requirements.
In many organizations, the real challenge begins once the requirements and areas for improvement have been identified.
The action plan may include vulnerability management, implementing secure updates, monitoring components, testing, documentation, and new operating models. At the same time, product development should continue as usual.
Wirokit’s experts work as part of our clients’ product development teams and help turn requirements into practical solutions. We can step in at whatever stage you’re currently at—from assessing the current situation to technical implementation and ongoing maintenance.
Here are some practical ways we can help:
“The key is to identify what the CRA means for your specific product and product development, and then turn the necessary changes into practical actions. The goal is not to do things simply for the sake of compliance, but to tailor the solutions to what the product and its operating environment actually require.”
- Mika Maunumaa, Senior Software Engineer
CRA reporting requirements take effect on September 11, 2026. When an actively exploited vulnerability or serious security incident that meets the reporting threshold is detected, the process of gathering the necessary information, making decisions, and reporting must begin promptly.
In practice, preparing for reporting means that responsibilities, channels, and operating models must be defined before the first reportable incident occurs.
Does the CRA apply to our products?
We have decades of experience in developing systems that are critical to operations and safety. Wirokit's experts are accustomed to working in environments where software must meet high standards of reliability, security, and quality. The CRA provides a new statutory framework for this activity.
Is ISO 27001 already in use?
ISO 27001 provides a solid foundation for, among other things, risk management, the definition of responsibilities, supplier management, and the management of documented evidence. However, that alone does not cover the CRA's product-specific requirements. The CRA also requires, among other things, product-specific risk management, secure development practices, vulnerability management, technical documentation, and demonstration of compliance.
“We know we need to do something, but we don’t know where to start.”
CRA readiness can be at very different stages across different companies. You may still be figuring out how the CRA affects your products. The areas for improvement may already be identified, but practical action has not yet begun. Or some of the requirements may already be in place, but areas such as vulnerability management, updates, or documentation still need improvement.
We can join in right where you are right now. We help identify the most critical areas for improvement and, above all, integrate the necessary measures into the practical product development process.
We can join you right where you are right now. We help identify the most critical areas for improvement and, above all, integrate the necessary measures into the practical product development process.
R&D Partner & Expert in Mission-Critical Software & QA
Harder code
