STAN4CRA
Governance Structure

Technical Work

Explore the technical committees and working groups driving CRA standardization across European Standards Organisations.

CRA Standardization Request

Regulation (EU) 2024/2847, known as the Cyber Resilience Act (CRA), establishes cybersecurity requirements for products with digital elements throughout their lifecycle.

To support compliance, the European Commission has issued a standardization request (Mandate M/606) to CEN, CENELEC, and ETSI for the development of harmonized standards. These standards are essential: products that comply with them are presumed to meet the CRA's requirements.

Scope

CEN, CENELEC and ETSI, the European Standardization Organizations, play a central role in implementing the CRA. Through their technical committees, they are developing horizontal and vertical standards that address the Act's essential cybersecurity requirements.

These standards aim to:

  • • Ensure a consistent and robust approach to cyber resilience across the EU Single Market
  • • Support the principles of cybersecurity-by-design and by-default
  • • Adapt to specific sectoral use cases and risk analysis

What are harmonized standards?

Harmonized standards are European standards developed by CEN, CENELEC, or ETSI at the request of the European Commission.

Voluntary in nature, they offer a reliable method for manufacturers, economic operators, and conformity assessment bodies to demonstrate compliance with EU legislation. Alternative technical solutions may also be used to meet legal requirements.

Structure of the CRA Standardization Work

To address the CRA's broad scope, the standardization work is divided into two categories:

Horizontal Standards

  • • Product-agnostic and framework-oriented
  • • Provide a foundational approach to cybersecurity applicable across sectors
  • • Serve as a basis for more detailed vertical standards
  • • Help manufacturers define and implement baseline security measures, especially for products not yet covered by sector-specific standards

The cornerstone is the 'Principles of Cyber Resilience' standard, developed by CEN-CLC/JTC 13 WG9 (entry 1 in Annex I). It provides a framework for all key elements listed in Section 1 of the Annex and guides the development of all related cybersecurity standards under the CRA.

Vertical Standards

  • • Product-specific, focusing on the unique cybersecurity needs of different digital product categories
  • • Should be based on risk analysis and reflect differences in intended purpose and foreseeable use
  • • Should reflect the state-of-the-art in the specific sectors

By developing these harmonized standards, the European Standardization Organizations are helping ensure that digital products across the EU are secure by design and resilient to evolving cyber threats, strengthening trust in the European Digital Single Market.

Technical Committees

CEN-CLC/JTC 13 WG 9
CEN-CENELEC

Cybersecurity and Data Protection

Development of standards for cybersecurity and data protection covering all aspects of the evolving information society including but not limited to: Management systems, frameworks, methodologies Data protection and privacy Services and products evaluation standards suitable for security assessment for large companies and small and medium enterprises (SMEs) Competence requirements for cybersecurity and data protection Security requirements, services, techniques and guidelines for ICT systems, services, networks and devices, including smart objects and distributed computing devices Included in the scope is the identification and possible adoption of documents already published or under development by ISO/IEC JTC 1 and other SDOs and international bodies such as ISO, IEC, ITU-T, and industrial fora. Where not being developed by other SDO's, the development of cybersecurity and data protection CEN/CENELEC publications for safeguarding information such as organizational frameworks, management systems, techniques, guidelines, and products and services, including those in support of the EU Digital Single Market. Working Group 6 — Product Security JTC 13/WG 6 covers cybersecurity related standardization work for products which covers both product requirements and process requirements (security by design and by default). The current CRA related work items are the deliverables for the smart meter gateway and the work items related to the EN 18037 based sector specific risk assessment for the CRA. Working Group 9 — Special Working Group on Cyber Resilience Act JTC 13/WG 9 develops the horizontal cybersecurity standards for the CRA. These standards define the generic state-of-the-art for the activities the manufacturer must execute to develop and maintain secure products. One deliverable addresses the overall security by design expectations during the total product life cycle; one deliverable addresses the vulnerability handling requirements while the third deliverable provides a catalog of product security controls that could be used to achieve compliance to the essential requirements for the hardware and software products in scope of the CRA. These standardization deliverables have a dual purpose. They can be used directly by manufacturers to develop and maintain products in the default class and can also be used by standardizers to develop the vertical CRA deliverables which might set more specific requirements applicable to a specific type or group of products.

Related Topics

TOPIC 1TOPIC 2–14TOPIC 15TOPIC 40
CLC/TC 47X
CENELEC

Semiconductors and Trusted Chips Implementation

The CLC/TC 47X 'Semiconductor device and trusted chips' fosters the development and use of trustworthy semiconductor devices for microelectronics and embedded systems in the European Union. TC 47X aims to establish a common framework in accordance with environmentally good practices for the design, manufacture, and use of semiconductor devices and trusted chips, with a focus on improving security, privacy, and resilience against cyber-attacks. The TC 47X is part of a broader effort by the European Union to improve cybersecurity and protect critical infrastructure against cyber threats. The TC 47X will: Provide the necessary infrastructure to the European industry and experts to discuss the related future standardization activities. Adopt the relevant standards developed by IEC/TC 47 and its subcommittees, as per the provisions of the Frankfurt Agreement. Address the standardization gaps identified by TC 47X and liaisons partners or a future European standardization roadmap. Develop European standards in response to the relevant standardization requests prepared by the European Commission (e.g. in support of the European Chips Act), particularly in terms of chips security, traceability and trustworthiness. Seek to establish a compliance process to develop chips safely, enabling consumers and businesses to identify and choose products that meet scalable security standards. Working Group 1 — Microprocessors and Microcontrollers with security related functionalities The group activities will focus on defining harmonized standards enabling third-party assessment of Cyber Resilience Act (CRA) compliance for MCUs and MPUs with tamper resistance for which scope has been defined as from hardware to generic software (e.g. OS, libraries) with a resistance to a JIL basic/enhanced basic potential of attack. Those activities will be built on existing standards such as SESIP (Security Evaluation for IoT Products). As a first step, this group will identify all relevant protection profiles for such MCUs and MPUs with tamper-resistance in the context of the CRA. A critical part of the work will be to identify and address gaps in the CRA Cybersecurity Essential Requirements (CRA, Annex I of the Draft CRA proposal Text). Manufacturers' reporting obligations in the event of security incidents (CRA, Article 11 of the draft CRA proposal) should also be covered as part of the work. Working Group 2 — Tamper resistant Microprocessors and Microcontrollers The group's activities will focus on defining harmonized standards enabling self-assessment of Cyber Resilience Act (CRA) compliance for MCUs and MPUs that provide security functions without tamper-resistance claims, building on existing standards such as SESIP (Security Evaluation Standard for IoT Products). As a first step, this group will identify all relevant protection profiles for MCUs and MPUs without tamper-resistance claims in the context of the CRA. A critical part of the work will be to identify and address gaps in the CRA Cybersecurity Essential Requirements (CRA, Annex I of the Draft CRA proposal Text). Manufacturers' reporting obligations in the event of security incidents (CRA, Article 11 of the draft CRA proposal) should also be covered as part of the work. Working Group 3 — SmartCards and Secure Element Platforms The activities will be focused on the harmonization with the Cyber Resilience Act (CRA) of the Common Criteria Protection Profiles (PPs) addressing the smart card/secure element platforms, i.e. the high end tamper resistant hardware of a smart card/secure element and the generic software like cryptographic libraries and optional Operating Systems running on it. These PPs are the de facto worldwide reference standards in the area of smart card security. Prominent examples are the Eurosmart Secure IC PP 0084, the Oracle Java Card PP 0099 and PP 0101, and the TCG TPM PP, to cite some. As a first step, WG3 will identify all such relevant PPs in the context of the CRA. An essential part of the work will be the identification and filling in the gaps between the essential cybersecurity CRA requirements (CRA, Annex I of the CRA draft proposal text). Reporting obligations of manufacturers in case of security incidents (CRA, Article 11 of the CRA draft proposal text) should also be covered as part of the work.

Related Topics

TOPIC 28, 29TOPIC 30TOPIC 37, 38TOPIC 41a, 41b
CEN/TC 224 WG 17
CEN

Personal identification and related personal devices

The development of standards for strengthening the interoperability and security of personal identification and its related personal devices, systems, operations and privacy in a multi sectorial environment. It covers: Operations such as applications and services like electronic identification, electronic signature, payment and charging, access and border control; Personal devices with secure elements independently of their form factor, such as cards, mobile devices, and their related interfaces; Security services including authentication, confidentiality, integrity, biometrics, protection of personal and sensitive data; System components such as accepting devices, servers, cryptographic modules; CEN/TC 224 multi-sectorial environment involves sectors such as Government/Citizen, Transport, Banking, e-Health, as well as Consumers and providers from the supply side such as card manufacturers, security technology, conformity assessment body, software manufacturers. Working Group 17 — Protection Profiles in the context of SSCD Working on European Standards in response to the CRA Standardization Request, Annex I listed below. Convenor: Marc Le Guin

Related Topics

TOPIC 16TOPIC 39
CLC/TC 65X WG 3
CENELEC

Industrial-process measurement, control and automation

To contribute, support and coordinate the preparation of international standards for systems and elements used for industrial process measurement, control and automation at CENELEC level. To coordinate standardisation activities which affect integration of components and functions into such systems including safety and security aspects. This CENELEC work of standardisation is to be carried out for equipment and systems and closely coordinated with IEC TC65 and its subcommittees with the objective of avoiding any duplication of work while honouring standing agreements between CENELEC and IEC. Working Group 3 — Cyber Security Developments based on EN IEC 62443 based on the existing project to update the broad vertical (WI= 81487 – EN IEC 62443-4-1:2018/prAA and WI= 79973 EN IEC 62443-4-2:2019/prAA) using the scheme by the EN IEC 62443-1-5. Developments for vertical standards focused on the OT aspects.

Related Topics

TOPIC 20aTOPIC 21aTOPIC 22aTOPIC 25aTOPIC 27aTOPIC 36a
ETSI TC CYBER
ETSI

ETSI Technical Committee on Cyber Security

The rapid evolution and growth in the complexity of new systems and networks, coupled with the sophistication of changing threats, present demanding challenges for maintaining the security of Information and Communications Technologies (ICT) systems and networks. Security solutions must include a reliable and secure network infrastructure, but they must also protect the privacy of individuals and organizations. Security standardization, sometimes in support of legislative actions, has a key role to play in protecting the Internet and the communications and business it carries. We offer market-driven cybersecurity standardization solutions, along with advice and guidance to users, manufacturers, network, infrastructure and service operators and regulators. Terms of Reference The main responsibilities of ETSI TC CYBER are: To act as the ETSI centre of expertise in the area of Cyber Security Advise and assist all ETSI Groups with the development of Cyber Security requirements To develop and maintain the Standards, Specifications and other deliverables to support the development and implementation of Cyber Security standardization within ETSI To collect and specify Cyber Security requirements from relevant stakeholders To identify gaps where existing standards do not fulfil the requirements and provide specifications and standards to fill these gaps, without duplication of work in other ETSI committees and partnership projects To ensure that appropriate Standards are developed within ETSI in order to meet these requirements To perform identified work as sub-contracted from ETSI Projects and ETSI Partnership Projects To coordinate work in ETSI with external groups such as ENISA To answer to policy requests related to Cyber Security, and security in broad sense in the ICT sector. Areas of Activity The activities of TC CYBER are performed in close co-operation with relevant standards activities within and outside ETSI. The activities of ETSI TC CYBER include the following broad areas: Cyber Security Security of infrastructures, devices, services and protocols Security advice, guidance and operational security requirements to users, manufacturers and network and infrastructure operators Security tools and techniques Provision of security mechanisms to protect privacy Creation of security specifications and alignment with work done in other TCs. Working Groups TC CYBER has two Working Groups focusing on specific areas: Quantum-Safe Cryptography EU Standardisation Requests , including developing harmonised standards for vertical product categories in support of the Cyber Resilience Act.

Related Topics

TOPIC 17aTOPIC 17bTOPIC 18TOPIC 19TOPIC 23TOPIC 24TOPIC 26TOPIC 31TOPIC 32TOPIC 33TOPIC 34TOPIC 35