.png&w=3840&q=75&dpl=dpl_4WWtFHEr9P8wkcdWCGky2WYKjEiM)
What is a remote data-processing solution (RDPS) under the CRA?
Direct answer
A remote data-processing solution is software the manufacturer designs to run at a distance, whose absence would prevent the connected product performing a core function. Under Article 3(2) the CRA treats such a solution as part of the product, so its security falls within scope even though it runs in the cloud.
Key takeaways
- Defined in Article 3(2).
- Three elements: distance processing · product depends on it for a core function · designed by or under the manufacturer's responsibility.
- Treated as part of the product, so it inherits the product's CRA obligations.
- Distinguishes integral backends from ordinary third-party cloud dependencies.
The full answer
A remote data-processing solution (RDPS) is distance processing that the manufacturer designs, and that the connected product needs in order to perform a core function (Art. 3(2)). When those conditions are met, the CRA treats the remote software as part of the product itself, so it carries the same essential requirements, vulnerability handling and reporting duties.
The distinction matters for architecture. A manufacturer's own backend that a device cannot function without is in scope; general third-party infrastructure the product merely runs on is an external dependency, not part of the CRA product boundary. Teams building products that straddle local hardware and cloud should map which remote components are functionally essential, because those are the ones the CRA follows.
How Acuna GRC handles it
- Solution
CRA
Track every vulnerability to a verified fix, keep CRA technical documentation, record exploited vulnerabilities, check component suppliers and reuse NIS2.
- Module
Vulnerability management
Vulnerable items from your scanners rolled up into one issue per vulnerability, with an owner and a due date.
- Core workspace
Comply
The frameworks you select, the scopes and tags that segment your organization, the common measures library and the mapping of measures across frameworks.
Sources
This page explains the rules in general terms and is not legal advice.
See how Acuna GRC runs this.
Tell us your frameworks and your team. We show you how Acuna GRC runs the program.
Hosted in Switzerland, the EU or the US