Routers and network devices under the CRA

The classification

Routers, modems for internet connection and switches are important products of class I, as are network management systems and physical or virtual network interfaces. Firewalls and intrusion detection and prevention systems are important products of class II: a notified body or a European certification is foreseen for them.

What matters in practice

A minimal attack surface: no management interfaces reachable from the internet out of the box, no default passwords, a secured update path with signed firmware and logging of security-relevant events. The SBOM must cover the entire firmware, including purchased libraries.

Radio and lifetime

Devices with Wi-Fi are already subject to the Radio Equipment Directive (EN 18031). Routers often stay in use for many years: the support period must reflect this expected period of use.