> ## Documentation Index > Fetch the complete documentation index at: https://docs.matproof.com/llms.txt > Use this file to discover all available pages before exploring further. # Getting Started with the Cyber Resilience Act > A practical guide to meeting CRA product security requirements for manufacturers, importers, and distributors of products with digital elements. # Getting Started with the Cyber Resilience Act The Cyber Resilience Act (CRA) establishes mandatory cybersecurity requirements for **products with digital elements** sold on the EU market. This covers hardware and software products that can connect to a device or network - from IoT devices and operating systems to firmware and standalone software applications. The CRA entered into force on December 10, 2024. Reporting obligations for actively exploited vulnerabilities begin **September 11, 2026**, and the full set of product security requirements becomes enforceable on **December 11, 2027**. Matproof maps CRA obligations to controls, evidence workflows, and vulnerability management processes so manufacturers can demonstrate compliance to market surveillance authorities. Activate the CRA under **Settings - Frameworks - Cyber Resilience Act**. Controls are pre-populated based on whether your products are classified as default, important (Class I or II), or critical. *** ## Am I in Scope? The CRA applies to any organization that places products with digital elements on the EU market: | Role | Definition | Key Obligations | | ---------------- | ------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | | **Manufacturer** | Develops or has a product developed and markets it under their name | Full compliance: secure by design, vulnerability handling, technical documentation, conformity assessment | | **Importer** | Places a product from a non-EU manufacturer on the EU market | Verify manufacturer compliance, ensure product bears CE marking, maintain documentation | | **Distributor** | Makes a product available on the EU market (without modifying it) | Verify CE marking and documentation, report known vulnerabilities to manufacturer | Open source software developed in a non-commercial context is generally excluded. However, if an open source project is used commercially or integrated into a commercial product, the CRA may apply to the integrator as the manufacturer. *** ## Product Classification The CRA uses a tiered classification for products with digital elements: | Category | Examples | Conformity Assessment | | ------------------------ | ----------------------------------------------------------------------------------------------------- | --------------------------------------------- | | **Default** | Most consumer and business software, IoT devices without critical functions | Self-assessment (Annex VIII) | | **Important - Class I** | Password managers, VPNs, network management systems, security information and event management (SIEM) | Harmonised standard or third-party assessment | | **Important - Class II** | Operating systems, firewalls, tamper-resistant microprocessors, industrial automation systems | Third-party assessment required | | **Critical** | Hardware devices with security boxes, smart meter gateways, smartcards | European cybersecurity certification required | Most software products fall into the default category and can use self-assessment. Check Annexes III and IV of the regulation for the complete product lists in each class. *** ## Key Enforcement Dates | Date | Milestone | | ------------------ | ------------------------------------------------------------------------------------------------- | | December 10, 2024 | Regulation enters into force | | June 11, 2026 | Conformity assessment bodies can begin operating | | September 11, 2026 | **Vulnerability and incident reporting obligations apply** | | December 11, 2027 | **Full enforcement** - all product security requirements, conformity assessments, penalties apply | *** ## Core Requirements in Matproof **Controls** Products must be designed and developed with appropriate cybersecurity measures from the start. No known exploitable vulnerabilities at time of release. **Incidents, Controls** Manufacturers must identify and remediate vulnerabilities throughout the product's expected lifetime (minimum 5 years). Provide security updates free of charge. **Evidence, Policies** Maintain documentation covering security architecture, risk assessment, SBOM (Software Bill of Materials), and testing results. **Audit Programs** Complete the applicable conformity assessment procedure before placing the product on the market. Affix CE marking. **Incidents** Report actively exploited vulnerabilities to ENISA within 24 hours of becoming aware. Report severe incidents within 72 hours. **Controls** Provide timely, free security updates for the entire support period. Document your update delivery mechanism. *** ## Recommended Implementation Plan ### Step 1 - Inventory your products with digital elements List every product your organization manufactures, imports, or distributes that connects to a device or network. 1. Go to **Controls - CRA - Product Inventory** 2. For each product, document: product name, version, intended use, connectivity type, and expected product lifetime 3. Classify each product (default, important Class I/II, or critical) ### Step 2 - Conduct product security risk assessments For each product: 1. Go to **Risk Management - New Risk Assessment** 2. Assess cybersecurity risks based on the product's intended use, connectivity, and data processed 3. Document risk mitigation measures built into the product design 4. Include risks from third-party components and dependencies ### Step 3 - Implement secure development practices The CRA requires security to be integrated into the development lifecycle: * Implement secure coding standards and code review processes * Conduct security testing (static analysis, dynamic analysis, fuzz testing) * Manage third-party dependencies and track known vulnerabilities * Generate and maintain a **Software Bill of Materials (SBOM)** for each product * Document these practices in your Secure Development Policy Go to **Policies - Generate** to create your CRA-aligned Secure Development Policy. ### Step 4 - Establish vulnerability handling Set up your vulnerability management process: 1. Configure the **Incidents** module for vulnerability intake (from researchers, users, and monitoring) 2. Define your coordinated vulnerability disclosure policy 3. Establish a process for issuing security updates within a reasonable timeframe 4. Maintain a vulnerability log with remediation timelines 5. Provide a public contact point for vulnerability reports From September 2026, you must report actively exploited vulnerabilities to ENISA within 24 hours of becoming aware. Set up your reporting workflow before this deadline. ### Step 5 - Build technical documentation The CRA requires comprehensive technical documentation including: * Product description and intended purpose * Security architecture and design decisions * Risk assessment results * SBOM listing all components and dependencies * Testing and validation results * Instructions for secure configuration and use Upload all documentation as evidence against the relevant CRA controls in Matproof. ### Step 6 - Conformity assessment Complete the applicable assessment procedure: 1. Go to **Audit Programs - New Audit - CRA** 2. For default products: complete the self-assessment using the internal control procedure (Annex VIII) 3. For Important Class II and Critical products: engage a notified body for third-party assessment 4. Affix CE marking and draft the EU declaration of conformity 5. Register in the EU product database where required ### Step 7 - Post-market monitoring After placing the product on the market: 1. Monitor for new vulnerabilities in your product and its components 2. Issue security updates as needed and notify users 3. Report actively exploited vulnerabilities to ENISA (24-hour deadline from September 2026) 4. Report severe security incidents within 72 hours 5. Update technical documentation when the product changes materially *** ## Penalties | Violation | Maximum Penalty | | -------------------------------------------------- | -------------------------------------------------------------------- | | Essential cybersecurity requirements (Annex I) | Up to 15M EUR or 2.5% of global annual turnover, whichever is higher | | Other CRA obligations | Up to 10M EUR or 2% of global annual turnover, whichever is higher | | Incorrect or misleading information to authorities | Up to 5M EUR or 1% of global annual turnover, whichever is higher | *** ## Next Steps * [Risk Management](/features/risk-management) - product security risk assessments * [Incidents](/features/incidents) - vulnerability reporting and handling workflows * [Audit Programs](/features/audit-programs) - conformity assessment procedures * [Vendor Risk](/features/vendor-risk) - managing third-party component risks in your supply chain