The National Cyber Security Centre (NCSC), under the Department of Justice, Home Affairs and Migration, has published Ireland's National Cyber Resilience Act (CRA) Guidelines.
The Cyber Resilience Act (CRA) (Regulation (EU) 2024/2847)1 is a landmark EU Regulation that entered into force on the 10th December 2024. It establishes mandatory cyber security standards for all connected hardware and software products sold in the EU. The purpose is to ensure that digital products are designed, developed, and produced with security in mind and that manufacturers remain responsible for vulnerability handling throughout the product’s full lifecycle.
CRA Objectives
- Enforce standards during product design to enhance the cybersecurity of products and encourage secure-by-design.
- Introduce vulnerability management obligations for the handling and patching of vulnerabilities through the lifetime of a product.
- Improve transparency for users regarding security updates and support periods.
- Encourage a harmonised and resilient digital market across the EU.
A staged approach to implementation of the CRA has commenced and spans from December 2024 to December 2027 to allow manufacturers sufÏcient time to adapt to these new security requirements. The mandatory reporting obligations under Article 14 of the CRA commence from the 11th September 2026, where entities with products in scope must report actively exploited vulnerabilities and severe incidents impacting product security.
Guidelines on reporting obligations under Article 14 of the Cyber Resilience Act (CRA)
The National Cyber Security Centre (NCSC), under the Department of Justice, Home Affairs and Migration, has published Ireland's National Cyber Resilience Act (CRA) Guidelines.
