Compliance Standards for Cyber Resilience Act (CRA)

Defines requirements for a secure development lifecycle for products used in industrial automation and control systems. Covers security requirements for development processes, including security by design, threat modeling, and secure coding practices.

Specifies technical security requirements for components (embedded devices, host devices, network devices, and software applications) used in industrial automation and control systems.

Specifies requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS). Provides a systematic approach to managing sensitive company information.

Collection of practical guidelines and best practices published by ENISA covering IoT security, vulnerability disclosure, supply chain security, and incident handling aligned with EU regulatory requirements.

Provides guidance for application security throughout the software development lifecycle. Defines concepts, principles, and processes for integrating security into applications.

Specifies requirements for how vendors should handle vulnerabilities internally, from receipt through remediation and verification. Complements ISO 29147 on disclosure.

Provides guidelines for how vendors should receive information about potential vulnerabilities in their products or online services, and how they should coordinate with external researchers and other parties.

Provides guidance on information security in supplier relationships, including supply chain security. Addresses how to secure information and ICT supply chains.