EU Cyber Resilience Act (CRA)

Mapping harmonisierter Normen zu den CRA-Anforderungen

Struktur des CRA-Standards-Mappings

Dieses CRA-Standards-Mapping stellt die verschiedenen Cyber-Resilience-Act-Standards in einem strukturierten, tabellenbasierten Format dar und erleichtert so die Navigation in einer ansonsten komplexen und sich weiterentwickelnden Landschaft.
Die Zuordnung ist nach Produktkategorien organisiert — Horizontal, Wichtig Klasse I, Wichtig Klasse II und Kritisch— und jeder Eintrag zeigt die wichtigsten Informationen zu einem bestimmten Thema, einschließlich der zugehörigen Norm oder des Entwurfs, der verantwortlichen Arbeitsgruppe, des aktuellen Status sowie Links zu unterstützenden Materialien wie Entwürfen oder Webinaren. Da sich viele CRA-Standards noch in der Entwicklung oder Konsultation befinden, hilft diese Struktur dabei, einen klaren und aktuellen Überblick über den Fortschritt des Standardisierungsprozesses zu geben.

Wie dieses CRA-Standards-Mapping in der Praxis verwendet wird

Dieses Cyber-Resilience-Act-Standards-Mapping ist so konzipiert, dass es während der Arbeit an der CRA-Compliance schnell konsultiert werden kann. Es ermöglicht Ihnen, zu identifizieren, welche Standards für Ihr Produkt relevant sind, ihren aktuellen Reifegrad zu verstehen und direkt auf zusätzliche Informationen wie Entwurfsspezifikationen oder Experten-Webinare zuzugreifen. Da sich viele Standards noch weiterentwickeln, hilft Ihnen dieses Mapping, deren Entwicklung zu verfolgen und zukünftige Anforderungen zu antizipieren, anstatt auf endgültige harmonisierte Versionen zu warten.

Horizontale CRA-Standards

Topic ID	Topic	Key standard(s)	Working group(s)	Relevant links and webinars
1	Principles for CyberResilience (Horizontal)	prEN 40000-1-2 prEN 40000-1-1	CEN-CLC/JTC13 WG 9, PT1	Webinar 'Standards supporting the Cyber Resilience Act'
1	Both standards have completed public enquiry and advanced through formal voting. Both standards EN 40000-1-1 and 1-2 has reached stage closure of voting. Final publication is expected in November 2026. Status: Public Enquiry closed → finalisation/approval
2–14	Generic Security Requirements (Horizontal)	prEN 40000-1-4 (Generic Security Requirements)	CEN-CLC/JTC13 WG 9, PT2	Webinar 'Standards supporting the Cyber Resilience Act' Webinar 'Unlocking CRA Security Controls' Webinar 'Generic Security Requirements'
2–14	Development of prEN 40000-1-4 continues within CEN-CLC/JTC 13/WG 9, PT2. The standard will establish generic security requirements and controls supporting CRA Annex I, Part I, and provide a horizontal reference for product-specific standards. No completed public enquiry or formal approval has been verified. Status: In development.
15	Vulnerability handling (Horizontal) – PT3	prEN 40000-1-3 (Vulnerability Handling)	CEN-CLC/JTC13 WG 9, PT3	Webinar 'Standards supporting the Cyber Resilience Act'
15	Public enquiry completed in March 2026. Comment resolution was completed on 31 July 2026, and the revised draft was submitted to the European Commission for pre-Formal Vote HAS assessment on 3 August 2026. Formal approval and publication remain pending. Status: Post-enquiry finalisation and Pre-Formal Vote HAS assessment.

Standards für die Important Class I Category

Topic ID	Topic	Key standard(s)	Working group(s)	Relevant links and webinars
16	Identity management systems and privileged access management (PAM) software/hardware, incl. authentication & access control readers (incl. biometric readers)	prEN40000-10	CEN/TC 224 WG17	Webinar CRA 'Requirements for identity management systems'
16	Status: In Development
17a / 17b	Standalone (17b) and embedded browsers (17a)	EN 304 617	ETSI CYBER EUSR	Draft ETSI EN 304 617
17a / 17b	ETSI EUSR mature draft for browsers (standalone & embedded). Status: Public Enquiry / approval process
18	Password managers	EN 304 618	ETSI CYBER EUSR	Draft ETSI EN 304 618
18	ETSI EUSR mature draft for password managers. Status: Public Enquiry / approval process.
19	Software that searches for, removes, or quarantines malicious software	EN 304 619	ETSI CYBER EUSR	Draft ETSI EN 304 619
19	ETSI EUSR mature draft for antivirus/antimalware products. Status: Public Enquiry / approval process.
20a / 20b	Products with digital elements with the function of virtual private network (VPN)	EN 304 620 prEN 50770-4	ETSI CYBER EUSR (20a) CLC/TC 65X WG3 (20b)	Draft ETSI EN 304 620 Webinar 'CRA Standards Unlocked: from EN IEC 62443 to CRA'
20a / 20b	ETSI EUSR mature draft for VPN products. CENELEC T65X: OT mapping based on 62443 series (WI 81652- Vertical: prEN 50XXX-4). Status: EN 304 620 - VPN Public enquiry \| prEN 50770-4 OT VPN In development.
21a / 21b	Network management systems	EN 304 621 prEN 50770-2	ETSI CYBER EUSR (21a) CLC/TC 65X WG3 (21b)	Draft ETSI EN 304 621
21a / 21b	ETSI EUSR mature draft for network management systems. CENELEC T65X: OT mapping based on 62443 series (WI 81654- Vertical: prEN 50XXX-6). Status: EN 304 621 Public Enquiry \| prEN 50770-2 Under development
22a / 22b	Security information and event management (SIEM) systems	EN 304 622 prEN 50770-6	ETSI CYBER EUSR (22a) CLC/TC 65X WG3 (22b)	Draft ETSI EN 304 622 Webinar 'CRA Standards Unlocked: from EN IEC 62443 to CRA'
22a / 22b	ETSI EUSR mature draft for SIEM systems. CENELEC T65X: OT mapping based on 62443 series (WI 81651- Vertical: prEN 50XXX-3). Status: EN 304 622 Public Enquiry \| prEN 50770-6 In development
23	Boot managers	EN 304 623	ETSI CYBER EUSR	Draft ETSI EN 304 623
23	ETSI EUSR mature draft for boot managers. Status: Public Enquiry / approval process
24	Public key infrastructure (PKI) and digital certificate issuance software	EN 304 624	ETSI CYBER EUSR	Draft ETSI EN 304 624
24	ETSI EUSR mature draft for PKI & certificate issuance software. Status: Public Enquiry / approval process
25	Physical and virtual network interfaces	EN 304 625 prEN 50770-3	ETSI CYBER EUSR CENELEC T65X	Draft ETSI EN 304 625
25	ETSI EUSR mature draft for network interfaces. CENELEC T65X: OT mapping based on 62443 series (WI 81653- Vertical: prEN 50XXX-5). Status: EN 304 625 Public Enquiry \| prEN 50770-3 In development
26	Operating systems	EN 304 626	ETSI CYBER EUSR	Draft ETSI EN 304 626
26	ETSI EUSR mature draft for operating systems. Status: Public Enquiry / approval process
27	Routers, modems intended for internet connection, and switches	EN 304 627 prEN 50770-5	ETSI CYBER EUSR CENELEC T65X	Draft ETSI EN 304 627
27	ETSI EUSR mature draft for routers/modems/switches. CENELEC T65X: OT mapping based on 62443 series (WI 81650- Vertical: prEN 50XXX-2). Status: EN 304 627 Public Enquiry \| prEN 50770-5 In development EN 304 627 Guide for CRA Compliance
28	Microprocessors with security-related functionalities	EN50765	CLC/TC 47X WG 1	SEMI Presentation
28	Referenced in SEMI presentation (Sept 17, 2025). Status: Public Enquiry closed
29	Microcontrollers with security-related functionalities	EN50765	CLC/TC 47X WG 1	SEMI Presentation
29	Referenced in SEMI presentation (Sept 17, 2025). Status: Public Enquiry closed
30	ASIC and FPGA with security-related functionalities	EN50767	CLC/TC 47X WG 4	SEMI Presentation
30	Referenced in SEMI presentation (Sept 17, 2025). Status: In development.
31	Smart home general purpose virtual assistants	EN 304 631	ETSI CYBER-EUSR	Draft ETSI EN 304 631
31	ETSI EUSR mature draft for Smart home general purpose virtual assistants Status: ETSI approval process
32	Smart home products with security functionalities (e.g., smart door locks, security cameras, baby monitors, alarm systems)	EN 304 632	ETSI CYBER-EUSR	Draft ETSI EN 304 632
32	ETSI EUSR mature draft for Smart home products with security functionalities Status: ETSI approval process EN 304 632 Guide for CRA Compliance
33	Internet connected toys (Directive 2009/48/EC) with social interaction or location tracking	EN 304 633	ETSI CYBER-EUSR	Draft ETSI EN 304 633
33	ETSI EUSR mature draft for Internet Connected toys. Status: ETSI approval process EN 304 633 Guide for CRA Compliance
34	Personal wearable products (non-MDR/IVDR) incl. children’s wearables with health monitoring purpose	EN 304 634	ETSI CYBER-EUSR	Draft ETSI EN 304 634
34	ETSI EUSR interim draft for Personal wearable products. Status: Public Enquiry / approval process

Standards für die Important Class II Category

Topic ID	Topic	Key standard(s)	Working group(s)	Relevant links and webinars
35	Hypervisors and container runtime systems that support virtualised execution of OS and similar environments	EN 304 635	ETSI CYBER-EUSR	Draft ETSI EN 304 635
35	ETSI docbox mature draft for virtualisation/container runtime. Status: Public Enquiry / approval process
36a / 36b	Firewalls, intrusion detection and prevention systems	EN 304 636 EN 62443-5-XX (reference listed)	ETSI CYBER EUSR (36a) CLC/TC 65X WG 3 (36b)	Draft ETSI EN 304 636 Webinar 'CRA Standards Unlocked: from EN IEC 62443 to CRA'
36a / 36b	ETSI docbox mature draft for firewalls; additional reference to IEC/EN 62443-5-XX listed. CENELEC T65X: OT mapping based on 62443 series (WI 81649- Vertical: prEN 50XXX-1). Status: Approval process / EC assessment EN 304 636 Guide for CRA Compliance
37	Tamper-resistant microprocessors	EN 50766; SESIP (EN 17927:2023); Under consideration: Common Criteria (EN 18045-3:2022); FiT CEM	CLC/TC 47X WG 2	SEMI Presentation
37	References SESIP and potential Common Criteria/FiT CEM; SEMI presentation link provided. Status: Public Enquiry closed
38	Tamper-resistant microcontrollers	EN 50766; SESIP (EN 17927:2023); Under consideration: Common Criteria (EN 18045-3:2022); FiT CEM	CLC/TC 47X WG 2	SEMI Presentation
38	References SESIP and potential Common Criteria/FiT CEM; SEMI presentation link provided. Status: Public Enquiry closed

Standards für die Critical Category

Topic ID	Topic	Key standard(s)	Working group(s)	Relevant links and webinars
39	Hardware devices with security boxes	prEN 40000-11	CEN/TC 224 WG17	Webinar 'CRA Standards Unlocked: HWSB '
39	Public enquiry completed (Q3 2026). Post-enquiry review ongoing; final approval pending. Publication expected Q1 2027. Status: In development (CEN stage 40.60)
40	Smart meter gateways within smart metering systems		CLC/TC JTC13 WG6	Webinar 'CRA Standards Unlocked: Smart Meters' Part 1 Webinar 'CRA Standards Unlocked: Smart Meters' Part 2
40	Development of the CRA harmonised standard for smart meter gateways is ongoing within CEN-CLC/JTC 13/WG 6. The work builds on Common Criteria and the Smart Meter Gateway Protection Profile (BSI-CC-PP-0073). No published harmonised standard or confirmed final approval date is available. Status: In development
41a / 41b	Smartcards or similar devices, including secure elements	EN 18330: Application layer (41B). EN 50764 Underlying platforms and secure ICs (41A)	CLC/TC 47X WG 3 CEN/TC 224 WG17	Webinar 'CRA Standards Unlocked' Presentation 'CRA Standards Unlocked'
41a / 41b	Public enquiries completed in March 2026 for prEN 50764 (underlying platforms and secure ICs) and prEN 18330 (application layer). Both standards remain in the post-enquiry development phase, pending comment resolution, final approval and publication. Publication is currently projected for 2027. The standards reference Common Criteria, EUCC and relevant SOGIS Protection Profiles. Status: Public enquiry closed and Final approval pending.

Wie Applus+ Laboratories Sie bei CRA-Standards-Mapping und der Vorbereitung auf die Compliance unterstützen kann

Applus+ Laboratories unterstützt Hersteller dabei, das sich entwickelnde CRA-Standards-Mapping zu verstehen, indem regulatorisches Know-how mit praktischer Cybersicherheitskompetenz kombiniert wird. Wir verfolgen kontinuierlich die Entwicklung der Cyber-Resilience-Act-Standards, einschließlich Entwürfen und Arbeitsgruppen, um Ihnen zu helfen zu verstehen, was für Ihre Produkte relevant ist und wie sich Anforderungen konkretisieren. Über das Mapping hinaus unterstützen wir Sie dabei, diese Standards in konkrete Maßnahmen zu übersetzen, sodass Ihre Vorbereitung mit den neuesten Entwicklungen übereinstimmt und auf die zukünftige Cyber Resilience Act Compliance ausgerichtet ist.