.png&w=3840&q=75&dpl=dpl_4WWtFHEr9P8wkcdWCGky2WYKjEiM)
What are the Cyber Resilience Act product classes?
Direct answer
The Cyber Resilience Act sorts products into four groups by risk: default (self-assessment), important class I and important class II (stricter routes), and critical (mandatory certification). Classification follows the product's core function, and where more than one class could apply, the stricter one governs.
Key takeaways
- Default: the majority of products; self-assessment (Module A).
- Important class I (e.g. password managers, VPNs, network management): harmonised standards or a third party.
- Important class II (e.g. operating systems, firewalls, microprocessors): third-party assessment.
- Critical (e.g. smart meters, smart cards, secure elements): mandatory certification.
- Categories are set in Annexes III and IV; the stricter class governs overlaps (Art. 6, 7).
The full answer
The conformity route a product must follow depends on its risk class (Art. 6, 7; Annex III, IV). Classification follows the product's core functionality, not every feature it includes, and where more than one category could apply the stricter one governs.
- Default -- most products with digital elements; the manufacturer self-assesses (Module A).
- Important, class I -- for example password managers, network management and VPNs; conformity via harmonised standards or a third party.
- Important, class II -- for example operating systems, firewalls and microprocessors; third-party assessment.
- Critical -- for example smart meters, smart cards and secure elements; mandatory certification.
How Acuna GRC handles it
- Solution
CRA
Track every vulnerability to a verified fix, keep CRA technical documentation, record exploited vulnerabilities, check component suppliers and reuse NIS2.
- Module
Vulnerability management
Vulnerable items from your scanners rolled up into one issue per vulnerability, with an owner and a due date.
- Core workspace
Comply
The frameworks you select, the scopes and tags that segment your organization, the common measures library and the mapping of measures across frameworks.
Sources
This page explains the rules in general terms and is not legal advice.
See how Acuna GRC runs this.
Tell us your frameworks and your team. We show you how Acuna GRC runs the program.
Hosted in Switzerland, the EU or the US