Cyber Resilience Act Readiness for Software & Products

About Cyber Resilience Act

The Cyber Resilience Act (CRA) is the EU regulation that sets cybersecurity requirements for many products with digital elements sold in the European market. Customers increasingly expect the products they buy to be secure by design, responsibly maintained, and supported when vulnerabilities emerge. For product companies, cybersecurity cannot be treated as a final testing step or a policy owned only by one technical specialist.

For product companies, cybersecurity cannot be treated as a final testing step or a policy owned only by one technical specialist. It needs to be connected to product strategy, architecture, secure development, supplier selection, vulnerability management, updates, customer communication, support, and leadership oversight.

Boxfish Labs helps teams build a proportionate product-security programme before compliance becomes an emergency. We assess your product and development reality, identify the CRA-related questions and risks most relevant to you, and turn them into a practical roadmap that supports product trust, customer requirements, and more resilient growth.

Who this is for

Software vendors making applications, platforms, SaaS products, developer tools, or other products with digital elements available in the EU

Key product-security capability areas

Secure by design and by default

Security requirements and risk decisions are addressed early in product design and architecture. Default settings, access, data handling, dependencies, interfaces, and operational controls are designed to reduce avoidable exposure.

Secure development lifecycle

A repeatable approach to integrating security into planning, design, implementation, review, testing, release, deployment, change, and maintenance. The appropriate activities depend on your product and risk profile.

Software supply-chain security

Visibility and governance for libraries, open-source software, SDKs, APIs, build pipelines, external development, cloud platforms, model providers, firmware, and other components that can introduce security or availability risk.

Vulnerability management and disclosure

Clear processes for receiving reports, monitoring sources, assessing severity, prioritising remediation, coordinating fixes, communicating with customers, publishing advisories where needed, and learning from recurring weaknesses.

Updates, patching, and support lifecycle

A practical model for security updates, patching, version support, end-of-support decisions, customer communication, change management, and evidence that the product can be maintained securely over time.

Product-security governance

Defined roles and accountability across leadership, product, engineering, security, support, legal, privacy, and suppliers. This includes decision-making authority, risk acceptance, escalation, reporting, and review.

Technical documentation and evidence

A maintainable evidence base covering product scope, security requirements, risk assessments, architecture, components, testing, vulnerabilities, updates, supplier arrangements, decisions, and lifecycle activities.

Incident readiness and recovery

Preparation for product-security incidents: detection, escalation, technical response, containment, recovery, customer communication, regulatory considerations, lessons learned, and improvement.

FAQs

Does the Cyber Resilience Act apply to SaaS products?

Applicability depends on the product, its functions, how it is made available, and the organisation’s role in the value chain. The CRA covers many products with digital elements, but the exact interpretation can be nuanced. We can help establish a practical product inventory and readiness view; for formal legal interpretation, work with qualified legal counsel.

Is the CRA only relevant to IoT devices or hardware?

No. The CRA concerns products with digital elements and can be relevant beyond connected hardware. Software products, applications, components, and connected systems may all need to consider applicability and lifecycle cybersecurity responsibilities.

Do we need a dedicated product-security team?

Not always. Smaller organisations can establish proportionate product-security roles, practices, and external support before they need a full dedicated team. The important point is clear ownership, repeatable processes, and the ability to manage risk throughout the product lifecycle.

What is the relationship between CRA and ISO 27001?

ISO 27001 helps establish organisational information-security management, governance, risk management, and continuous improvement. CRA readiness focuses on cybersecurity requirements for products with digital elements throughout their lifecycle. An ISO 27001 programme can provide useful foundations, but it does not automatically cover all product-specific CRA expectations.

Can you help us create a vulnerability-disclosure process?

Yes. We can help design practical vulnerability intake, triage, severity assessment, remediation, communication, disclosure, record-keeping, and improvement processes that fit your product, customers, team, and support model.

Can you provide legal advice on CRA applicability and obligations?

We provide practical cybersecurity, governance, risk, privacy, human-factors, and implementation support. For formal legal interpretation or legal representation, consult qualified legal counsel. We can collaborate with your counsel to translate applicable requirements into usable product, engineering, and operational practices.

How Boxfish Labs can help

Information Security Advisory

Get a focused CRA readiness assessment, product-security gap analysis, framework interpretation, risk roadmap, policy guidance, evidence review, and support for customer or stakeholder requirements. Useful when: you need to understand the product-security work ahead, respond to a customer question, assess a new product, or launch a defined readiness project. Explore: Information Security Advisory

Virtual CISO

Gain ongoing senior cybersecurity leadership for product-security strategy, risk oversight, governance, secure-development priorities, vulnerability-management maturity, executive reporting, and continuous improvement. Useful when: product cybersecurity needs sustained leadership and accountability across engineering, product, operations, suppliers, and leadership. Explore: Virtual CISO

Data Residency and Sovereignty Strategy

Map product data flows, cloud and SaaS dependencies, supplier concentration, data locations, third-country exposure, access patterns, recovery needs, and regional alternatives that affect resilience and customer trust. Useful when: your product relies on cloud infrastructure, external platforms, AI services, data-intensive workflows, or suppliers that create critical availability and sovereignty dependencies. Explore: Data Residency and Sovereignty Strategy

Human-Centric Cybersecurity Awareness

Build security capability across the people who design, build, launch, support, and operate products. Use role-aware learning for secure development, vulnerability reporting, secure product decisions, incident response, and customer communication. Useful when: product and engineering teams need practical security habits that go beyond generic corporate awareness training. Explore: Human-Centric Cybersecurity Awareness

External DPO

Connect product-security work with personal-data processing, privacy-by-design, DPIAs, vendor and processor arrangements, transparency, retention, breach response, and the GDPR obligations relevant to your product. Useful when: your product processes personal data or product-security decisions overlap with privacy, customer-data, and contractual responsibilities. Explore: External DPO

Build secure products that stay secure throughout their lifecycle.

About Cyber Resilience Act

Who this is for

What the Cyber Resilience Act means in practice

Challenges we help solve

You are unsure whether the CRA applies to your product

Security is happening too late in product development

You do not have a formal vulnerability-management process

You lack visibility of software components and dependencies

Product security has unclear ownership

Customers need better security answers

People need secure-development and reporting habits

A practical CRA readiness roadmap

01 - Understand products, roles, and market context

02 - Map the product-security baseline

03 - Assess risk and prioritise gaps

04 - Build secure lifecycle practices

05 - Maintain, monitor, and improve