normakte / CRA risk assessment
The risk assessment is the foundation of all CRA obligations: it determines which requirements of Annex I are implemented and how – and it is kept up to date throughout the support period.
| Step | Content |
|---|---|
| 1. Purpose and environment | intended and reasonably foreseeable use, operational environment, users |
| 2. Assets | functions, data, interfaces |
| 3. Threats and attack surface | who could attack, through which paths |
| 4. Risk estimation | likelihood and impact |
| 5. Measures | mapping to the requirements of Annex I, justification where not applicable |
| 6. Residual risk and updates | remaining risks, updates on changes and new vulnerabilities |
The manufacturer assesses the cybersecurity risks of its product and takes the outcome into account during planning, design, development, production, delivery and maintenance. The assessment indicates whether and how the requirements of Annex I are applicable and implemented; it is documented, updated during the support period and becomes part of the technical documentation.
Harmonised standards for the CRA are currently being developed. Until then, existing standards provide orientation, such as EN 18031 for radio equipment, IEC 62443-4-1 and 4-2 for industrial components and ETSI EN 303 645 for consumer IoT.
For machines with digital elements, both assessments belong together: the Machinery Regulation requires protection against corruption and safe control systems, the CRA the cybersecurity of the product. A joint assessment avoids duplicate work and shows the synergies required by Recital 53 CRA.
Register, classification, SBOM, reports with deadlines and a target page for users – one trial file free until 20.01.2027.
Source. Regulation (EU) 2024/2847, OJ L, 2024/2847 of 20.11.2024. Summarised; only the official text is authoritative. normakte is not legal advice.