EU Cyber Resilience Act and NIS2

Products shall be designed, developed and produced in such a way that they ensure an appropriate level of cybersecurity based on the risks.

Products with digital elements shall be made available on the market without known exploitable vulnerabilities.

Products shall be made available with a secure by default configuration, including the possibility to reset the product to its original state.

Products shall ensure that vulnerabilities can be addressed through security updates, including, where applicable, automatic updates.

Products shall ensure protection from unauthorised access by appropriate control mechanisms, including but not limited to authentication, identity or access management systems.

Products shall protect the confidentiality of stored, transmitted or otherwise processed data, personal or other, such as by encrypting relevant data at rest or in transit by state of the art mechanisms.

Products shall protect the integrity of stored, transmitted or otherwise processed data, commands, programs and configuration against any manipulation or modification not authorised by the user, and report on corruptions.

Products shall protect the availability of essential and basic functions, also after an incident, including through resilience and mitigation measures against denial-of-service attacks.

Products shall minimise their own negative impact on the availability of services provided by other devices or networks.

Products shall be designed, developed and produced to limit attack surfaces, including external interfaces.

Products shall be designed, developed and produced to reduce the impact of an incident using appropriate exploitation mitigation mechanisms and techniques.

Products shall provide security related information by recording and monitoring relevant internal activity, including the access to or modification of data, services or functions.

Manufacturers shall identify and document vulnerabilities and components contained in the product, including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies of the product.

Manufacturers shall address and remediate vulnerabilities without delay, including by providing security updates; where technically feasible, new security updates shall be provided separately from functionality updates.

Manufacturers shall apply effective and regular tests and reviews of the security of the product with digital elements.

Manufacturers shall put in place and enforce a policy on coordinated vulnerability disclosure.

Manufacturers shall take measures to facilitate the sharing of information about potential vulnerabilities in their product as well as in third party components contained in that product, including by providing a contact address.

Manufacturers shall provide for mechanisms to securely distribute updates to ensure that vulnerabilities are fixed or mitigated in a timely manner.

Measures shall include policies on risk analysis and information system security.

Measures shall include incident handling.

Measures shall include supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers.

Measures shall include security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure.

Measures shall include policies and procedures to assess the effectiveness of cybersecurity risk-management measures.

Measures shall include policies and procedures regarding the use of cryptography and, where appropriate, encryption.

Measures shall include human resources security, access control policies and asset management.

Measures shall include the use of multi-factor or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity.