ETSI Proposes Cybersecurity Standards for EU Cyber Resilience Act Compliance

The European Telecommunications Standards Institute (ETSI) has proposed 17 cybersecurity standards to support the EU Cyber Resilience Act (CRA), which will be enforced from December 2027. These standards aim to ensure that manufacturers, developers, and vendors of digital products meet minimum security requirements, including modern cryptography and secure-by-default settings. The proposed standards cover a wide range of product categories, including network devices and IoT appliances. Stakeholders can provide feedback on these standards until mid-November 2026, with final versions expected by December 2026. The CRA emphasizes a forward-looking approach to cybersecurity, aligning with international guidelines for post-quantum cryptography (PQC) implementation by 2035. The CRA's impact will be significant as it mandates compliance for all hardware and software sold in the EU, affecting manufacturers and service providers across Europe.

Key Points: • ETSI proposed 17 cybersecurity standards for EU manufacturers under the Cyber Resilience Act. • The CRA mandates compliance for digital products sold in the EU starting December 2027. • Stakeholders can provide feedback on the proposed standards until mid-November 2026.