“You must report vulnerabilities within 24 hours”... EU CRA soon to be implemented, changing corporate security paradigm

Unlike most existing cybersecurity regulations, the EU's Cyber ​​Resilience Act (CRA) is characterized by a focus on ‘product safety’ rather than process or certification. The CE mark concept applied to physical products has been expanded to include software, firmware, back-end services, and all elements connected to the network. The law also institutionalizes existing best practices, enforces minimum product support life cycles, and requires increased collaboration with open source projects on which companies rely.