According to Art. 1 (c) of the planned Cyber Resilience Act (CRA-E) this regulation should also include provisions for vulnerability handling processes put in place by manufacturers.

The purpose of these processes is to ensure the cybersecurity of products with digital elements during the whole life cycle.

The CRA-E does not specify a precise definition for vulnerability handling procedures. Instead, Art. 5 (2) CRA-E stipulates an obligation for the manufacturer to carry out corresponding procedures before making a product available on the market and refers to Annex I Section 2 with regard to the requirements.

This obligation is taken up again in Art. 10 (6) CRA-E. According to this, vulnerabilities must be handled effectively and in accordance with the essential requirements set out in Section 2 of Annex I CRA-E for a maximum period of 5 years. The measures mentioned in Section 2 suggest that the term "vulnerability handling processes" means methods such as the identification, documentation, remediation or mitigation of vulnerabilities as well as information of authorities and product users.

Section 2 of Annex I of the CRA-E specifies the requirements for the treatment of vulnerabilities. The provisions mentioned there are to be understood as a kind of minimum requirement. The wording is unambiguous since the term "shall" directly obliges manufacturers to implement handling processes.

The requirements mentioned initially include the identification and documentation of vulnerabilities and components of the product. For this purpose, the regulation proposes to draw up a software bill of materials (SBOM) in a machine-readable format. Recently, the Federal Office for Information Security (BSI) has also taken up this recommendation and, referring to the CRA, has drafted a technical guideline for the preparation of a SBOM.

Furthermore, the CRA-E requires known vulnerabilities to be addressed immediately, e.g., by providing security updates. This update must be provided to users without delay and free of charge. In this context, information about eliminated vulnerabilities together with information about their impact and severity must be published. In addition, manufacturers must provide mechanisms for the secure distribution of updates so that exploitable vulnerabilities can be fixed quickly.

Moreover, manufacturers are required to carry out testing measures and review the product with digital elements. This could include, for example, penetration tests or fuzz testing procedures to detect programming errors and security vulnerabilities.

Furthermore, the CRA demands a strategy from manufacturers for coordinated disclosure of vulnerabilities. This is likely to mean, for example, the implementation of a documented corporate process by which manufacturers can ensure that product users are informed.

As a further requirement, Section 1 of Annex I provides for information sharing measures (in particular with third parties whose components have been incorporated into the product in question), for example by providing a contact address for reporting discovered vulnerabilities.

The aforementioned requirements are likely to apply regardless of the type of product with digital elements and thus generally to manufacturers' vulnerability handling proccesses.

According to Art. 10 (7) CRA-E, the conformity of the procedures for dealing with vulnerabilities must also be ensured with a conformity assessment procedure.

If, due to a circumstance, the manufacturer's procedures no longer comply with the requirements of Annex I CRA-E from the time the product with digital elements is placed on the market, corrective measures must be taken. This obligation applies for a maximum period of 5 years from the date the product is placed on the market.

Practical recommendations:

Even though the CRA-E is still in the legislative process and comprehensive changes to the regulation are therefore not ruled out, manufacturers of products with digital elements should already address the aforementioned requirements for vulnerability handling processes and, if possible, implement initial procedures. Furthermore, we suggest that implementation is fully documented for verification purposes. This is because implementation represents one of the core obligations of the CRA-E and is indispensable for a successful implementation of the conformity procedure.

Since the importer must also ensure that the requirements in Annex I Section 2 are met and even a distributor may not make such a product available on the market if there are doubts about conformity, we also recommend that these economic operators familiarize themselves with the requirements in Annex I of the CRA-E in order to be able to carry out an appropriate review of those products.

In our CRA-Update series, we regularly present information on the proposed Cyber Resilience Act and keep you informed about changes in the ongoing legislative process. In each of our articles, we give you a brief overview of a specific topic, presenting the most important aspects and practical implications.