Helping You Navigate the EU Cyber Resilience Act
The EU Cyber Resilience Act (CRA) is intended to give manufacturers, integrators and end users greater confidence that products with digital elements placed on the EU market are designed and maintained with cybersecurity in mind. The regulation takes a risk management approach to cybersecurity, requiring manufacturers to assess cybersecurity risks throughout the product lifecycle and implement measures that meet the CRA's mandatory essential cybersecurity requirements. These obligations extend from product design and development through vulnerability management, security updates, and end-of-support.
Analog Devices (ADI) has a strong foundation in secure product development, demonstrated by being certified to IEC 62443-4-1 for industrial systems and ISO/SAE 21434 for automotive applications, and by aligning medical technologies with ANSI/AAMI SW96 and AAMI TIR57. Through years of implementing security-by-design, risk management, and lifecycle security processes, ADI has developed expertise that is now being applied across its broader product portfolio to help customers create secure and resilient solutions with confidence.
By integrating cybersecurity throughout the product lifecycle—from concept and architecture through design, validation, and ongoing support—ADI helps customers build secure products using practices aligned with the CRA’s lifecycle-oriented and risk-based approach, including risk assessment, secure development, vulnerability management, and continuous support for products with digital elements.
Will the CRA Affect Your Products?
If you design or manufacture connected products for the European market, the answer is likely yes. The CRA applies to a broad range of hardware and software products with digital elements, including products built using technologies such as microcontrollers, processors, connectivity solutions, industrial sensing platforms and embedded software. The CRA establishes obligations for both ADI, as a manufacturer of products with digital elements, and OEMs that place their own products on the EU market. As a result, OEMs increasingly assess how suppliers support cybersecurity throughout the product lifecycle. ADI's security-by-design approach enables ADI to meet its own obligations while helping customers meet theirs.
How ADI Supports CRA Requirements
The CRA requires manufacturers to address cybersecurity throughout the lifecycle of products with digital elements. ADI helps customers address these expectations through three complementary pillars: product security requirements, vulnerability handling, and documentation and transparency obligations.
Product Security Requirements
In addition to methodology and documentation, ADI offers a suite of security technologies and product features that developers can leverage when designing CRA-compliant devices.
| Examples of Technical Features Relevant to Certain CRA Security Objectives | Methodology and Documentation | Security Technologies and Product Features | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Pre-Release Security Testing | Vulnerability Scanning | Documentation of Exposed Interface | Secure Boot | Hardware Root of Trust | Secure Enclave | Hardware Asymmetric Digital Signature | Hardware Symmetric Encryption | PSA Cryptographic API | Secure Storage | Access Control | Peripheral and Interface Enable/Disable Controls | |
| Be placed on the market without known exploitable vulnerabilities. | X | X | X | |||||||||
| Be secure by default | X | X | X | X | ||||||||
| Protect against unauthorized access | X | X | X | X | X | |||||||
| Protect confidentiality of data | X | X | X | X | ||||||||
| Protect integrity of data, software, commands, and configurations | X | X | X | |||||||||
| Limit attack surfaces | X | X | ||||||||||
The mapping in the table above is provided for reference. Achievement of CRA compliance depends on the overall product design, intended use, supporting processes, documentation, vulnerability management, and conformity assessment activities. The presence of a feature does not, by itself, establish compliance with the CRA.
Vulnerability Handling
The CRA places significant emphasis on post-market cybersecurity, requiring manufacturers to effectively handle vulnerabilities, maintain coordinated vulnerability disclosure processes, and provide relevant security-related information throughout the product support period. ADI's vulnerability management program is designed to support these objectives:
- PSIRT: ADI's Product Security Incident Response Team oversees receipt, triage, and coordinated disclosure of reported vulnerabilities
- SBOM: Developing a scalable Software Bill of Materials (SBOM) capability for CRA compliance, building on industry best practices for new and legacy software
- Security Advisories: Published without delay when vulnerabilities are confirmed, with patch or mitigation guidance
- Coordinated Disclosure Policy: ADI follows coordinated disclosure timelines, working with reporters before public release
Documentation and Transparency
The CRA places significant emphasis on transparency throughout the product lifecycle, requiring manufacturers to make cybersecurity-relevant information available to users and market authorities, communicate support periods, and provide information needed to manage vulnerabilities and security updates. ADI helps customers address these expectations through comprehensive technical documentation and product lifecycle communications:
- Datasheet and reference manual documentation of security features and their configuration
- Cybersecurity-relevant technical documentation available to support customer conformity assessments
- Defined product support periods communicated at launch
- Security update delivery mechanisms documented per product
Supporting Your Product Lifecycle
Product Definition
- Use ADI product security documentation to inform your threat and risk assessment, upon request and availability
- Leverage ADI's IEC 62443 / ISO/SAE 21434 risk-based approach alignment as evidence in your supply chain security assessment
Design & Development
- Use relevant ADI hardware security features (secure boot, Arm® TrustZone® Technology, crypto accelerators) to meet product security requirements
- Reference ADI security application notes and design guides
Validation
- Access ADI technical documentation:
- CE marking and EU Declaration of Conformity support for applicable ADI products
- Security test coverage and vulnerability history when available
Deployment & Maintenance
- Monitor ADI PSIRT advisories for ongoing vulnerability disclosures
- ADI patches and security updates delivered at no additional charge for supported products
- Coordinate with ADI on any field vulnerability reports that involve ADI components
Our Commitment to Security
Recognized frameworks such as IEC 62443, ISO/SAE 21434 against which ADI is certified, establish principles such as security-by-design, cybersecurity risk management, vulnerability handling, software supply chain transparency and lifecycle support, which are also reflected in the CRA. Building on this foundation, ADI maintains a set of governance practices, development processes and organizational capabilities that help strengthen its security posture and support customers' cybersecurity objectives.
- Industry-Standard Alignment: Product security processes designed to IEC 62443-4-1 (industrial) and ISO/SAE 21434 (automotive), ANSI/AAMI SW96 and AAMI TIR57
- PSIRT: Dedicated team for vulnerability intake, assessment, and coordinated public disclosure
- Open Source Governance: Dedicated Open Source Program Office (OSPO) supporting open source compliance, governance, and SBOM generation processes across ADI products
- Lifecycle Transparency: ADI will provide customers with relevant cybersecurity information to support their compliance with applicable EU Cyber Resilience Act (CRA) requirements, including information on vulnerability handling, security maintenance and support practices, security advisories, and Software Bills of Materials (SBOMs), as applicable
- Active CRA Monitoring: Tracking CRA implementing acts, harmonized standards, and ENISA guidance as they develop