Which harmonised standards apply to the CRA? Overview of the EN 40000 series, ETSI EN 304 6xx and EN 50770 with a summary of structure, status and what they mean for manufacturers.
For manufacturers this does not produce a single ‘CRA standard’, but a landscape of standards made up of several series: the horizontal EN 40000 series for all products with digital elements, product-specific ETSI standards for IT and consumer products, and the EN 50770 series for OT products based on IEC 62443. This article explains which series are currently being developed, how they interact and what manufacturers should already prepare before a listing in the Official Journal.
The presumption of conformity is the real lever behind harmonised standards. If a product with digital elements and the procedures defined by the manufacturer conform to a harmonised standard whose reference is published in the Official Journal, conformity with the essential requirements in Annex I is presumed, to the extent that the standard covers those requirements.
As long as such a standard is missing, the Commission can adopt common specifications by implementing act. Compliance with those common specifications can also satisfy the essential requirements. For manufacturers this means: the standards route is the preferred but not the only path to the presumption of conformity.
Important: The CRA applies regardless of whether the standards are harmonised in time. If a listed standard is missing, only the convenient proof path via the presumption of conformity is not available. The requirements nevertheless remain binding and must be demonstrated through the manufacturer’s own technical and organisational evidence.
What is the standardisation work for the CRA?
Standardisation work is running in three areas, carried out by the European standardisation organisations CEN, CENELEC and ETSI. One horizontal area applies to all products with digital elements; two vertical areas address specific product groups: one for IT and consumer products, and one for operational technology (OT).
| Track | Standard series | Addressed products | Basis |
|---|---|---|---|
| Horizontal | EN 40000 series | All products with digital elements | Basic requirements |
| Vertical IT/consumer | ETSI EN 304 6xx | IT and consumer products | Product specific |
| Vertical OT | EN 50770 series | OT products | based on IEC 62443 |
All three series are still under development and currently exist only as drafts. No concrete harmonisation or listing dates have been set.
Horizontal standards the EN 40000 series
The EN 40000 series is the horizontal basis. It is intended to apply to all products with digital elements, regardless of product category. Four parts form the normative core, complemented by an informative Technical Report. See EN 40000 series.
| Part | Function |
|---|---|
| EN 40000-1-1 | Terms and definitions for the whole series |
| EN 40000-1-2 | Principles for cyber resilience |
| EN 40000-1-3 | Handling of vulnerabilities |
| EN 40000-1-4 | Generic security requirements |
| EN TR 40000-1-5 | Threats and protection objectives (informative) |
For manufacturers EN 40000-1-2, EN 40000-1-3 and EN 40000-1-4 are especially relevant: principles and processes, vulnerability handling and generic security requirements will likely form central areas of evidence.
Vertical standards for IT and consumer products the ETSI EN 304 6xx series
For IT and consumer products a vertical series named ETSI EN 304 6xx is being developed. It addresses individual product types with their own product-specific requirements. Product types mentioned in the status overview include browsers, password managers, VPN solutions, SIEM systems, operating systems as well as routers and switches.
The drafts in this series are still at an early stage. They already show the planned structure and the first product-specific directions, but should not yet be treated as a stable basis for requirements. See first ETSI draft standards for the CRA for an overview.
Vertical standards for OT the EN 50770 series
The EN 50770 series is being developed for operational technology. It is primarily relevant for machine builders, automation manufacturers and suppliers of industrial components. The series defines security profiles for OT products, explicitly based on IEC 62443. The individual parts cover product groups such as VPN solutions, network management systems, SIEM systems, physical and virtual network interfaces, routers and switches as well as firewalls, intrusion detection and intrusion prevention systems.
This OT strand is supported by annex adaptations (prAA) of selected IEC 62443 parts: IEC 62443-3-3 (system requirements), IEC 62443-4-1 (secure product development process) and IEC 62443-4-2 (technical component requirements). These serve as supporting standards for the vertical OT standards. The EN 50770 series is currently a draft.
How far is your product with the CRA?
The CRA readiness check shows in a few minutes which requirements from Annex I you already meet and where gaps remain.
How do IEC 62443 and EN 18031 fit into the picture?
IEC 62443 is the established family of standards for the security of industrial automation and control systems and forms the foundation of the OT strand. It is still formally open which role IEC 62443 will play in the CRA harmonisation framework. Practically speaking, however, it remains a central reference point for OT manufacturers because the EN 50770 series explicitly builds on IEC 62443. See IEC 62443 for the CRA for the broader context.
Another reference is EN 18031. It is already used in the current CRA draft standards as a source of terminology. For manufacturers whose products communicate wirelessly, this provides a possible reference point for the later transition from the Radio Equipment Directive to the CRA. What exact role EN 18031 will play in this transition depends on the CRA standards that are still to come. See EN 18031 and the Radio Equipment Directive for details. For connected consumer products there is also the cybersecurity standard ETSI EN 303 645.
What does the status mean for manufacturers?
As long as no CRA standard is listed in the Official Journal of the European Union, the presumption of conformity via harmonised standards does not apply. But that does not mean manufacturers should wait. The essential requirements from Annex I of the Cyber Resilience Act remain decisive and must be demonstrated as part of the conformity assessment.
The current draft standards already show in which direction the later demonstration of conformity will develop. Manufacturers can therefore already check which standards strand is relevant for their products and which existing evidence can be used. It is not only important to know which standard will be harmonised later, but also how to provide robust evidence until then.
This leads to a pragmatic approach for manufacturers:
- Classify the product as a product with digital elements under the CRA
- Check the product class: standard product, important product or critical product
- Determine the appropriate standard series: horizontal, IT/consumer-specific or OT-specific
- Evaluate existing evidence from IEC 62443, EN 18031, ETSI EN 303 645 or internal development processes
- Derive gaps relative to Annex I, vulnerability handling and technical documentation
- Decide how evidence will be provided until harmonised standards are listed
The most common pitfall is waiting for finished standards. The CRA’s entry into force does not depend on whether harmonised standards have already been listed. Those who only build vulnerability handling, secure development processes, technical documentation and product evidence later will lose the time needed to establish exactly those structures.
Conclusion and outlook
The CRA standards landscape is organised along three strands: horizontally via the EN 40000 series, vertically via the ETSI EN 304 6xx series for IT and consumer products and via the EN 50770 series for OT. None of the three series has yet been finalised, and a listing in the Official Journal is still pending. The message for manufacturers is clear: the direction is set, the demonstration of conformity until listing runs via Annex I, and building the underlying processes is worthwhile now. See overview page on the CRA for the overall framework of the Cyber Resilience Act.
Which standard applies to your product?
We tell you which of the three series applies to your products and how you can provide evidence until one is listed in the Official Journal.
