Call us now:
The EU released the Cyber Resilience Act proposal on the 15th September 2022. The importance, complexity and significance of the Act cannot be underestimated, nor the penalties for non conformance. The proposed Act requires cybersecurity to be an integral part of products with digital elements, if they are to be sold and used in the EU. It is a very thorough document.
‘Products with digital elements shall be designed, developed and produced in such a way that they ensure an appropriate level of cybersecurity based on the risks’
It is a very comprehensive and significant Act that focuses on the manufacturers of digital products and their services. It sets out the obligations they will have to meet including cybersecurity risk assessment, vulnerability and patch, supply chain security of third party suppliers and cyber incident reporting.
It is not possible to list here all the products covered (Annex II and III) but it includes IDAMs, Network and communications, firewalls, microprocessors, Operating Systems, Operations Technology, VPN, SIEM, IoT, Smart Meters, HSMs, V&P software, IoC software, End Point software, PKI issuers.
The Act affects both products produced in the EU and those products and associated digital services entering the EU. Importers and distributors are obligated to ensure products with digital elements comply with the Act.
The Act also covers cyber incident reporting, ‘requiring without undue delay and in any event within 24 hours of becoming aware of it, notify to ENISA any actively exploited vulnerability contained in the product with digital elements’. Reporting to both users and regulators.
The U.S and EU are developing regulations that will enforce cybersecurity risk management both within and between nations.
Ted Dziekanowski
#cybersecurity #cyberriskmanagement #cyberregulation #theaugustagroup
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6977187909758029824