Why Harmonized Standards Matter

The Cyber Resilience Act (CRA) establishes a common set of cybersecurity requirements for products with digital elements sold in the European Union. However, the regulation itself does not explain every technical detail of how manufacturers should implement those requirements.

To help bridge that gap, the European Commission has asked the European Standards Organizations (CEN, CENELEC, and ETSI) to develop Harmonized Standards that support the implementation of the CRA. For IoT OEMs, these standards will become an important part of the compliance journey.

The Difference Between the CRA and Harmonized Standards

A simple way to understand the relationship is:

• The CRA defines what manufacturers must achieve.
• Harmonized Standards describe one practical way to demonstrate those requirements have been met.

For example, the CRA requires manufacturers to:

• Manage cybersecurity risks
• Handle vulnerabilities
• Deliver security updates
• Protect products throughout their lifecycle

The regulation explains what is expected, while the standards provide guidance on how those expectations can be implemented and assessed.

Why Should IoT OEMs Care?

Many manufacturers assume that reading the CRA is enough. In reality, demonstrating compliance is often just as important as implementing security features. Harmonized Standards are expected to provide a common technical basis for conformity assessments, making it easier for manufacturers to demonstrate that their products meet the CRA requirements. This is particularly valuable when preparing technical documentation, supporting CE marking, and communicating with regulators or customers.

Compliance Is More Than Security Features

Meeting the CRA is not simply about adding encryption, secure boot, or authentication. Manufacturers also need consistent processes for:

• Software and firmware management
• SBOM maintenance
• Vulnerability handling
• Security updates
• Product lifecycle documentation

These operational capabilities are increasingly becoming part of compliance, not just product security.

What Should Manufacturers Do Now?

Although many Harmonized Standards are still under development, manufacturers do not need to wait before preparing. Organizations can already begin by:

• Building a secure development process
• Maintaining accurate SBOMs
• Establishing vulnerability response procedures
• Managing security updates throughout the product lifecycle
• Keeping clear technical and operational records

These practices not only support today's security needs but also prepare organizations for future CRA compliance.

Final Thoughts

The CRA defines the destination. Harmonized Standards help manufacturers understand the road to get there. For IoT OEMs, compliance will increasingly depend not only on secure products, but also on standardized processes that can be consistently demonstrated and maintained throughout the product lifecycle.

References

• Cyber Resilience Act - Standardisation
• Cyber Resilience Act (CRA)
• Cyber Resilience Act: Standardization Request Officially Accepted by CEN, CENELEC, and ETSI‍