What is the EU CRA

The EU Cyber Resilience Act enhances cybersecurity standards of products that contain a digital component, requiring manufacturers to ensure cybersecurity throughout the lifecycle of their products.

The Cyber Resilience Act introduces mandatory cybersecurity requirements for manufacturers and retailers, governing the planning, design, development, and maintenance of such products. These obligations must be met at every stage of the value chain. The act also requires manufacturers to provide care during the lifecycle of their products. Some critical products of relevance for cybersecurity will also need to undergo a third-party assessment by an authorized body before they are sold in the EU market.

The regulation applies to all products connected directly or indirectly to another device or network except for specified exclusions such as certain open-source software or services products that are already covered by existing rules, which is the case for medical devices, aviation and cars. Products will bear the CE marking to indicate that they comply with the CRA requirements. The new rules will rebalance responsibility towards manufacturers, who must ensure their products with digital elements meet cybersecurity standards for the EU market. 

Honeywell Approach to the Cyber Resilience Act

Security is foundational to everything we do at Honeywell. We take a holistic approach by embedding cybersecurity throughout our organization and our offerings. Our secure development practices follow industry standards, including IEC 62443, and are reinforced throughout the product lifecycle. We are proactively assessing the impact of the EU Cyber Resilience Act (CRA) on our operations and investing to ensure compliance as the law’s obligations come into effect. We are closely tracking the European standardization efforts through CEN and CENELEC and participating in the development of standards that support CRA implementation. This collaboration will help align our practices to the CRA’s new standards and ensure a more secure future for the industries we serve.

Honeywell EU CRA Vulnerability reporting process 

See more about Honeywell Security Process here https://www.honeywell.com/us/en/company/trust-center#security

All of Honeywell businesses are certified to the IEC 62443-4-1 process as listed here: https://www.honeywell.com/us/en/company/trust-center#compliance

Q&A from Honeywell Security Process: https://www.honeywell.com/us/en/company/trust-center#faq