Governance, risk & compliance

EU Cyber Resilience Act (CRA) 2024

SecurityEU

Regulation (EU) 2024/2847 — Cyber Resilience Act, entered into force 10 December 2024.

Establishes mandatory cybersecurity requirements for products with digital elements (hardware and software) sold in the EU. Manufacturers must ensure security by design, provide security updates for product lifetime (minimum 5 years), report actively exploited vulnerabilities to ENISA within 24 hours, and maintain technical documentation.

Applies to manufacturers, importers, and distributors. Fines up to 15M EUR or 2.

5% of global turnover.

Official reference: https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act

How Lavawall® helps you get to EU Cyber Resilience Act (CRA) compliance

Most of EU Cyber Resilience Act (CRA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to EU Cyber Resilience Act (CRA), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against EU Cyber Resilience Act (CRA) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports EU Cyber Resilience Act (CRA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.