EU Cyber Resilience Act (CRA)

Cartographie des normes du Cyber Resilience Act (CRA)

Comment cette cartographie des normes CRA est structurée

Cette cartographie des normes du Cyber Resilience Act présente les différentes normes du CRA dans un format structuré sous forme de tableau, facilitant la navigation dans un paysage autrement complexe et en constante évolution.
La cartographie est organisée par catégorie de produit — Horizontal, Important Classe I, Important Classe II et Critique— et chaque entrée présente les informations clés pour un sujet spécifique, y compris la norme ou le projet associé, le groupe de travail responsable, son statut actuel et des liens vers des ressources complémentaires telles que des projets ou des webinaires. Étant donné que de nombreuses normes CRA sont encore en cours de développement ou de consultation, cette structure permet d’avoir une vue claire et à jour de l’avancement du processus de normalisation.

Comment utiliser cette cartographie des normes CRA en pratique

Cette cartographie des normes du Cyber Resilience Act est conçue pour être consultée rapidement lors de travaux de mise en conformité au CRA. Elle vous permet d’identifier quelles normes sont pertinentes pour votre produit, de comprendre leur niveau de maturité actuel et d’accéder directement à des informations complémentaires telles que des projets de spécifications ou des webinaires d’experts. Comme de nombreuses normes sont encore en cours d’évolution, cette cartographie vous aide à suivre leur développement et à anticiper les exigences futures au lieu d’attendre les versions harmonisées finales.

Normes horizontales du CRA

Topic ID	Topic	Key standard(s)	Working group(s)	Relevant links and webinars
1	Principles for CyberResilience (Horizontal)	prEN 40000-1-2 prEN 40000-1-1	CEN-CLC/JTC13 WG 9, PT1	Webinar 'Standards supporting the Cyber Resilience Act'
1	Both standards have completed public enquiry and advanced through formal voting. Both standards EN 40000-1-1 and 1-2 has reached stage closure of voting. Final publication is expected in November 2026. Status: Public Enquiry closed → finalisation/approval
2–14	Generic Security Requirements (Horizontal)	prEN 40000-1-4 (Generic Security Requirements)	CEN-CLC/JTC13 WG 9, PT2	Webinar 'Standards supporting the Cyber Resilience Act' Webinar 'Unlocking CRA Security Controls' Webinar 'Generic Security Requirements'
2–14	Development of prEN 40000-1-4 continues within CEN-CLC/JTC 13/WG 9, PT2. The standard will establish generic security requirements and controls supporting CRA Annex I, Part I, and provide a horizontal reference for product-specific standards. No completed public enquiry or formal approval has been verified. Status: In development.
15	Vulnerability handling (Horizontal) – PT3	prEN 40000-1-3 (Vulnerability Handling)	CEN-CLC/JTC13 WG 9, PT3	Webinar 'Standards supporting the Cyber Resilience Act'
15	Public enquiry completed in March 2026. Comment resolution was completed on 31 July 2026, and the revised draft was submitted to the European Commission for pre-Formal Vote HAS assessment on 3 August 2026. Formal approval and publication remain pending. Status: Post-enquiry finalisation and Pre-Formal Vote HAS assessment.

Normes pour la catégorie Importante Classe I

Topic ID	Topic	Key standard(s)	Working group(s)	Relevant links and webinars
16	Identity management systems and privileged access management (PAM) software/hardware, incl. authentication & access control readers (incl. biometric readers)	prEN40000-10	CEN/TC 224 WG17	Webinar CRA 'Requirements for identity management systems'
16	Status: In Development
17a / 17b	Standalone (17b) and embedded browsers (17a)	EN 304 617	ETSI CYBER EUSR	Draft ETSI EN 304 617
17a / 17b	ETSI EUSR mature draft for browsers (standalone & embedded). Status: Public Enquiry / approval process
18	Password managers	EN 304 618	ETSI CYBER EUSR	Draft ETSI EN 304 618
18	ETSI EUSR mature draft for password managers. Status: Public Enquiry / approval process.
19	Software that searches for, removes, or quarantines malicious software	EN 304 619	ETSI CYBER EUSR	Draft ETSI EN 304 619
19	ETSI EUSR mature draft for antivirus/antimalware products. Status: Public Enquiry / approval process.
20a / 20b	Products with digital elements with the function of virtual private network (VPN)	EN 304 620 prEN 50770-4	ETSI CYBER EUSR (20a) CLC/TC 65X WG3 (20b)	Draft ETSI EN 304 620 Webinar 'CRA Standards Unlocked: from EN IEC 62443 to CRA'
20a / 20b	ETSI EUSR mature draft for VPN products. CENELEC T65X: OT mapping based on 62443 series (WI 81652- Vertical: prEN 50XXX-4). Status: EN 304 620 - VPN Public enquiry \| prEN 50770-4 OT VPN In development.
21a / 21b	Network management systems	EN 304 621 prEN 50770-2	ETSI CYBER EUSR (21a) CLC/TC 65X WG3 (21b)	Draft ETSI EN 304 621
21a / 21b	ETSI EUSR mature draft for network management systems. CENELEC T65X: OT mapping based on 62443 series (WI 81654- Vertical: prEN 50XXX-6). Status: EN 304 621 Public Enquiry \| prEN 50770-2 Under development
22a / 22b	Security information and event management (SIEM) systems	EN 304 622 prEN 50770-6	ETSI CYBER EUSR (22a) CLC/TC 65X WG3 (22b)	Draft ETSI EN 304 622 Webinar 'CRA Standards Unlocked: from EN IEC 62443 to CRA'
22a / 22b	ETSI EUSR mature draft for SIEM systems. CENELEC T65X: OT mapping based on 62443 series (WI 81651- Vertical: prEN 50XXX-3). Status: EN 304 622 Public Enquiry \| prEN 50770-6 In development
23	Boot managers	EN 304 623	ETSI CYBER EUSR	Draft ETSI EN 304 623
23	ETSI EUSR mature draft for boot managers. Status: Public Enquiry / approval process
24	Public key infrastructure (PKI) and digital certificate issuance software	EN 304 624	ETSI CYBER EUSR	Draft ETSI EN 304 624
24	ETSI EUSR mature draft for PKI & certificate issuance software. Status: Public Enquiry / approval process
25	Physical and virtual network interfaces	EN 304 625 prEN 50770-3	ETSI CYBER EUSR CENELEC T65X	Draft ETSI EN 304 625
25	ETSI EUSR mature draft for network interfaces. CENELEC T65X: OT mapping based on 62443 series (WI 81653- Vertical: prEN 50XXX-5). Status: EN 304 625 Public Enquiry \| prEN 50770-3 In development
26	Operating systems	EN 304 626	ETSI CYBER EUSR	Draft ETSI EN 304 626
26	ETSI EUSR mature draft for operating systems. Status: Public Enquiry / approval process
27	Routers, modems intended for internet connection, and switches	EN 304 627 prEN 50770-5	ETSI CYBER EUSR CENELEC T65X	Draft ETSI EN 304 627
27	ETSI EUSR mature draft for routers/modems/switches. CENELEC T65X: OT mapping based on 62443 series (WI 81650- Vertical: prEN 50XXX-2). Status: EN 304 627 Public Enquiry \| prEN 50770-5 In development EN 304 627 Guide for CRA Compliance
28	Microprocessors with security-related functionalities	EN50765	CLC/TC 47X WG 1	SEMI Presentation
28	Referenced in SEMI presentation (Sept 17, 2025). Status: Public Enquiry closed
29	Microcontrollers with security-related functionalities	EN50765	CLC/TC 47X WG 1	SEMI Presentation
29	Referenced in SEMI presentation (Sept 17, 2025). Status: Public Enquiry closed
30	ASIC and FPGA with security-related functionalities	EN50767	CLC/TC 47X WG 4	SEMI Presentation
30	Referenced in SEMI presentation (Sept 17, 2025). Status: In development.
31	Smart home general purpose virtual assistants	EN 304 631	ETSI CYBER-EUSR	Draft ETSI EN 304 631
31	ETSI EUSR mature draft for Smart home general purpose virtual assistants Status: ETSI approval process
32	Smart home products with security functionalities (e.g., smart door locks, security cameras, baby monitors, alarm systems)	EN 304 632	ETSI CYBER-EUSR	Draft ETSI EN 304 632
32	ETSI EUSR mature draft for Smart home products with security functionalities Status: ETSI approval process EN 304 632 Guide for CRA Compliance
33	Internet connected toys (Directive 2009/48/EC) with social interaction or location tracking	EN 304 633	ETSI CYBER-EUSR	Draft ETSI EN 304 633
33	ETSI EUSR mature draft for Internet Connected toys. Status: ETSI approval process EN 304 633 Guide for CRA Compliance
34	Personal wearable products (non-MDR/IVDR) incl. children’s wearables with health monitoring purpose	EN 304 634	ETSI CYBER-EUSR	Draft ETSI EN 304 634
34	ETSI EUSR interim draft for Personal wearable products. Status: Public Enquiry / approval process

Normes pour la catégorie Importante Classe II

Topic ID	Topic	Key standard(s)	Working group(s)	Relevant links and webinars
35	Hypervisors and container runtime systems that support virtualised execution of OS and similar environments	EN 304 635	ETSI CYBER-EUSR	Draft ETSI EN 304 635
35	ETSI docbox mature draft for virtualisation/container runtime. Status: Public Enquiry / approval process
36a / 36b	Firewalls, intrusion detection and prevention systems	EN 304 636 EN 62443-5-XX (reference listed)	ETSI CYBER EUSR (36a) CLC/TC 65X WG 3 (36b)	Draft ETSI EN 304 636 Webinar 'CRA Standards Unlocked: from EN IEC 62443 to CRA'
36a / 36b	ETSI docbox mature draft for firewalls; additional reference to IEC/EN 62443-5-XX listed. CENELEC T65X: OT mapping based on 62443 series (WI 81649- Vertical: prEN 50XXX-1). Status: Approval process / EC assessment EN 304 636 Guide for CRA Compliance
37	Tamper-resistant microprocessors	EN 50766; SESIP (EN 17927:2023); Under consideration: Common Criteria (EN 18045-3:2022); FiT CEM	CLC/TC 47X WG 2	SEMI Presentation
37	References SESIP and potential Common Criteria/FiT CEM; SEMI presentation link provided. Status: Public Enquiry closed
38	Tamper-resistant microcontrollers	EN 50766; SESIP (EN 17927:2023); Under consideration: Common Criteria (EN 18045-3:2022); FiT CEM	CLC/TC 47X WG 2	SEMI Presentation
38	References SESIP and potential Common Criteria/FiT CEM; SEMI presentation link provided. Status: Public Enquiry closed

Normes pour la catégorie Critique

Topic ID	Topic	Key standard(s)	Working group(s)	Relevant links and webinars
39	Hardware devices with security boxes	prEN 40000-11	CEN/TC 224 WG17	Webinar 'CRA Standards Unlocked: HWSB '
39	Public enquiry completed (Q3 2026). Post-enquiry review ongoing; final approval pending. Publication expected Q1 2027. Status: In development (CEN stage 40.60)
40	Smart meter gateways within smart metering systems		CLC/TC JTC13 WG6	Webinar 'CRA Standards Unlocked: Smart Meters' Part 1 Webinar 'CRA Standards Unlocked: Smart Meters' Part 2
40	Development of the CRA harmonised standard for smart meter gateways is ongoing within CEN-CLC/JTC 13/WG 6. The work builds on Common Criteria and the Smart Meter Gateway Protection Profile (BSI-CC-PP-0073). No published harmonised standard or confirmed final approval date is available. Status: In development
41a / 41b	Smartcards or similar devices, including secure elements	EN 18330: Application layer (41B). EN 50764 Underlying platforms and secure ICs (41A)	CLC/TC 47X WG 3 CEN/TC 224 WG17	Webinar 'CRA Standards Unlocked' Presentation 'CRA Standards Unlocked'
41a / 41b	Public enquiries completed in March 2026 for prEN 50764 (underlying platforms and secure ICs) and prEN 18330 (application layer). Both standards remain in the post-enquiry development phase, pending comment resolution, final approval and publication. Publication is currently projected for 2027. The standards reference Common Criteria, EUCC and relevant SOGIS Protection Profiles. Status: Public enquiry closed and Final approval pending.

Comment Applus+ Laboratories peut vous aider à mettre en correspondance les normes CRA et à vous préparer à la mise en conformité

Applus+ Laboratories aide les fabricants à s'y retrouver dans l'évolution de la cartographie des normes de la loi sur la cyber-résilience (CRA) en associant une expertise réglementaire à une expertise pratique en matière de cybersécurité. Nous suivons en permanence l'évolution des normes de la loi sur la cyber-résilience, y compris les projets et les groupes de travail, afin de vous aider à comprendre ce qui s'applique à vos produits et comment les exigences prennent forme. Au-delà de la cartographie, nous vous aidons à traduire ces normes en actions concrètes, en veillant à ce que votre préparation soit en phase avec les dernières évolutions et prête pour la mise en conformité future avec la Loi sur la Cyber-Résilience.