Glossary term
Cyber Resilience Act (CRA)
Also: EU Cyber Resilience Act, Regulation (EU) 2024/2847, CRA
EU Regulation 2024/2847 setting horizontal cybersecurity requirements for products with digital elements. Entered into force on 10 December 2024. Main obligations apply from 11 December 2027. Reporting duties for actively exploited vulnerabilities apply from 11 September 2026.
The Cyber Resilience Act covers nearly every networked hardware and software product placed on the EU market: IoT devices, industrial controllers, smart home appliances, operating systems, applications, developer tools. Open-source software is in scope only in commercial contexts; not-for-profit communities are exempt.
Manufacturer duties (Annex I): security-by-design, security-by-default, free security updates over the expected product lifetime (5 years minimum default), vulnerability-handling process, SBOM, conformity assessment with CE marking. Important products (Class I/II) need additional conformity procedures; critical products (Annex IV) require third-party assessment.
In practice
Reporting duties to ENISA and national CSIRTs: actively exploited vulnerabilities within 24 hours (early warning), 72 hours (incident notification), 14 days (final report). Fines up to 15 M EUR or 2.5 percent of worldwide group turnover. CRA conformity becomes a precondition for any EU market entry from December 2027.
Related terms
SBOM
Machine-readable inventory of all components in a software incl. versions, licences and dependencies. Formats: SPDX, CycloneDX, SWID. Mandatory in regulated areas; in the US driven by Executive Order 14028.
Supply Chain Risk
Risks from the software and hardware supply chain: compromised open-source packages, build-pipeline attacks, updates with backdoors, sub-suppliers without audit trail. Mandatory under NIS2 Art. 21 (d) and DORA Art. 28 (sub-outsourcing).
NIS2
EU directive on network and information security. Replaces NIS1, widens scope to around 30,000 German companies in 18 sectors, introduces personal management body liability, sets ten minimum cybersecurity measures under Article 21.
ICT Third-Party Risk
Sammelbegriff für Risiken aus dem Einsatz externer ICT-Lieferanten: Cloud-Provider, SaaS-Anbieter, MSPs, MSSPs. Unter DORA Art. 28 explizit reguliert; jeder kritische Lieferant muss in einem Register stehen und einer dokumentierten Eignungsprüfung folgen.
CASB
Security layer between users and SaaS providing visibility (shadow IT discovery), data protection (DLP), compliance, and threat protection across SaaS apps. Four functions per Gartner: visibility, compliance, data security, threat protection.
CNAPP
Gartner platform category that combines CSPM, CWPP, CIEM, KSPM, DSPM and IaC scanning into one tool. Answer to tool fragmentation in cloud security stacks.
Compliance mapping
The explicit link between a decision (vendor, architecture, control) and the specific regulatory articles, controls or standards it satisfies. Without compliance mapping, a memo cannot be defended under audit against a named clause.
Confidential Computing
Hardware-based isolation that keeps data encrypted during processing (data-in-use). Complements encryption at rest and in transit. Technologies: Intel SGX, Intel TDX, AMD SEV-SNP, ARM CCA, Nvidia H100 Confidential Computing.