The European Telecommunications Standards Institute (ETSI) has proposed 17 cybersecurity standards to support the EU Cyber Resilience Act (CRA), which will take full effect in December 2027. These standards are designed to ensure that manufacturers across Europe meet the CRA's requirements, which aim to enhance the cybersecurity of products sold in the EU. The proposed standards cover a wide range of product categories, including network and edge devices, security solutions, and internet-of-things (IoT) appliances. They mandate modern cryptography, secure-by-default settings, software bills of materials (SBOMs), and post-sale update capabilities. The standards are currently under public inquiry, with stakeholders invited to provide comments until mid-September to mid-November 2026. The final versions of these standards are expected to be available by December 2026, and they will apply to all manufacturers, importers, distributors, service providers, and developers of commercially available hardware and software products sold in the EU from the end of 2027. ETSI, along with the European Committee for Standardization (CEN) and the European Committee for Electrotechnical Standardization (CENELEC), has organized workshops to help small and medium businesses comply with the CRA. This initiative is crucial as it prepares manufacturers for the upcoming regulatory changes and ensures the cybersecurity of products sold in the EU, ultimately benefiting consumers and businesses alike.
